text: Background Personnel Security Clearances Personnel security clearances are required for access to certain national security information. National security information may be classified at one of three levels: confidential, secret, or top secret. The level of classification denotes the degree of protection required for information and the amount of damage that unauthorized disclosure could reasonably be expected to cause to national security. Specifically, unauthorized disclosure could reasonably be expected to cause (1) “damage,” in the case of confidential information; (2) “serious damage,” in the case of secret information; and (3) “exceptionally grave damage,” in the case of top secret information. As part of the security clearance process, individuals granted security clearances are investigated periodically—for as long as they remain in a position requiring access to classified information—to ensure their continued eligibility. As of October 1, 2015, the latest date for which data are available, approximately 4.2 million government and contractor employees, at nearly 80 executive branch agencies, were eligible to hold a security clearance. IRTPA, Executive Orders, and Recent Legislation IRTPA. As noted earlier, IRTPA initiated a reform effort that includes goals and requirements for improving the personnel security clearance process government-wide. For example, IRTPA established specific objectives for the timeliness of security clearance processing. It also required that all security clearance background investigations and determinations completed by an authorized investigative agency or authorized adjudicative agency be accepted by all agencies (known as reciprocity), subject to certain exceptions. Appendix II provides additional details on IRTPA as it relates to personnel security clearances. Relevant Executive Orders. The personnel security clearance process and reform efforts are governed by various executive orders. Key executive orders affecting personnel security clearance reform include Executive Orders 12968, 13467, 13741, and 13764, which, among other things, provide definitions, processes, responsibilities, and authorities related to eligibility for access to classified information, suitability and fitness for government employment, and security clearance reform. Aspects of the reform effort covered by the Executive Orders include the establishment of the PAC and NBIB, the transfer of IT responsibilities to DOD, the definition of continuous evaluation, and the addition and amendment of certain roles and responsibilities. Recent legislation. Section 951 of the National Defense Authorization Act for Fiscal Year 2017 requires, among other things, the Secretary of Defense to develop an implementation plan for the Defense Security Service to conduct background investigations for certain DOD personnel—presently conducted by OPM—after October 1, 2017. The Secretary of Defense was to submit the plan to the congressional defense committees by August 1, 2017. DOD provided the plan to the congressional defense committees on August 25, 2017. Section 951 also requires the Secretary of Defense and the Director of OPM to develop a plan by October 1, 2017, to transfer investigative personnel and contracted resources to DOD in proportion to the workload if the plan for the department to conduct background investigations were implemented. In November 2017, after the conclusion of our audit work, Congress passed a bill for the National Defense Authorization Act for Fiscal Year 2018. The bill includes a provision that, among other things, would authorize DOD to conduct its own background investigations and would require DOD to begin carrying out the implementation plan required by section 951 of the National Defense Authorization Act for Fiscal Year 2017 by October 1, 2020. It would also require the Secretary of Defense, in consultation with the Director of OPM, to provide for a phased transition. Governance Structure for Security Clearance Reform Effort To help guide the personnel security clearance reform effort, in June 2007, the Director of National Intelligence and the Under Secretary of Defense for Intelligence established the Joint Reform Team through a memorandum of agreement to execute joint reform efforts to achieve IRTPA timeliness objectives and improve the processes related to granting security clearances and determining suitability for government employment. The team consisted of cognizant entities within OMB, OPM, ODNI, and DOD. The team worked on improving the security clearance process governmentwide, including providing progress reports on the reform effort, recommendations for research priorities, and oversight of the development and implementation of an information technology strategy, among other things. In June 2008, Executive Order 13467 established the PAC as the government-wide governance structure responsible for driving the implementation of and overseeing security and suitability reform efforts. Its specific responsibilities include ensuring the enterprise-wide alignment of suitability, security, credentialing, and, as appropriate, fitness processes; working with agencies to implement continuous performance improvement programs, policies, and procedures; establishing annual goals and progress metrics; and preparing annual reports on results. In addition, the PAC is to develop and continuously reevaluate and revise outcome-based metrics that measure the quality, efficiency, and effectiveness of the vetting enterprise, among other things. As noted above, the Deputy Director for Management of OMB serves as the Chair of the PAC and has authority, direction, and control over its functions. In addition to the Deputy Director for Management of OMB, the PAC has three additional principal members: the Director of National Intelligence, the Director of OPM, and the Under Secretary of Defense for Intelligence. Director of National Intelligence: The Director of National Intelligence serves as the Security Executive Agent and is responsible for, among other things, developing and issuing uniform and consistent policies and procedures to ensure the effective, efficient, timely, and secure completion of investigations, polygraphs, and adjudications related to determinations of eligibility for access to classified information or eligibility to hold a sensitive position. In this role, the Director of National Intelligence is also to direct the oversight of such investigations, reinvestigations, and adjudications. Director of OPM: The Director of OPM serves as the Suitability and Credentialing Executive Agent and is responsible for, among other things, prescribing suitability standards and minimum standards of fitness for employment. Under Secretary of Defense for Intelligence: The Under Secretary of Defense for Intelligence became the fourth principal member of the PAC with the issuance of Executive Order 13741 in September 2016. Additionally, Executive Order 13467, as amended, assigns DOD responsibility for designing, developing, operating, defending, and continuously updating and modernizing, as necessary, IT systems that support all background investigation processes conducted by NBIB. In addition, in April 2014, the PAC established the Program Management Office to implement personnel security clearance reforms. This office includes subject-matter experts with knowledge of personnel security clearances and suitability determinations from OMB, ODNI, OPM, DOD, the Department of Homeland Security, the Department of Justice, the Department of the Treasury, and the Federal Bureau of Investigation. Prior to the establishment of the Program Management Office, the PAC was supported by the Joint Reform Team as well as various subcommittees that addressed specific tasks, such as investigator and adjudicator training and the development of performance measures. Key Efforts to Reform the Personnel Security Clearance Process Since 2014, there have been a number of key efforts to reform the personnel security clearance process. For example, following the September 2013 shooting at the Washington Navy Yard, the PAC conducted a 120-day interagency review to assess risks inherent in the federal government’s security, suitability, and credentialing processes. The February 2014 report resulting from that review highlighted 37 recommendations to improve, among other things, the federal government’s processes for granting security clearances. Some of the recommendations address longstanding issues of the reform effort—such as improving data sharing between local, state, and federal law enforcement; and others are consistent with previous GAO recommendations—such as reporting measures for the quality of background investigations. The status of the implementation of these recommendations is discussed later in this report. In addition, in March 2014, OMB established Insider Threat and Security Clearance Reform as a government-wide, cross-agency priority goal in part to improve interagency coordination and implementation within the area of personnel security clearances. Through this goal, the PAC and executive-branch agencies are to work to improve oversight to ensure that investigations and adjudications meet government-wide quality standards. From the second quarter of fiscal year 2014 to the fourth quarter of fiscal year 2016, the PAC has reported quarterly on, among other things, the status of key milestones and the timeliness of initial investigations and periodic reinvestigations for the executive branch as a whole. As part of the cross-agency priority goal, the PAC identified various sub goals on which to focus its work. The sub goals were originally based on recommendations from the 120-day review and, according to PAC Program Management Office officials, were later updated to reflect the PAC’s strategic plans. The current sub goals are as follows: trusted workforce, modern vetting, secure and mission-capable IT, and continuous process improvement. Further, in 2015, in response to the OPM data breach and at the request of the President, the PAC conducted a second review—a 90-day review—of the government’s suitability and security processes. In the January 2016 summary of the review, the administration identified four actions to create a more secure and effective federal background investigations infrastructure. Specifically, it identified the need to: (1) establish NBIB as the new federal entity to strengthen how the government performed background investigations; (2) leverage IT expertise at DOD for processing background investigations and protecting against threats; (3) update governance authorities, roles, and responsibilities; and (4) drive continuous performance improvement to address evolving threats. The status of these actions is discussed later in this report. NBIB’s Use of Contract Investigators to Conduct Background Investigations NBIB maintains an in-house federal investigator workforce, but according to NBIB, as of July 2017, it relied on contract investigators to conduct about 60 percent of the background investigations it provides to customer agencies, such as DOD. In 2011, OPM awarded three indefinite delivery/indefinite quantity contracts to three contractors to conduct investigation fieldwork services—CACI Premier Technology, Inc., KeyPoint Government Solutions, Inc., and U.S. Investigations Services, LLC (USIS). According to NBIB, USIS was responsible for about 65 percent of the contractor workload. In September 2014, OPM decided not to exercise the option for the USIS contract for fiscal year 2015. Eleven months prior, in October 2013, the Department of Justice had announced that the government would intervene in a civil suit against USIS, filed by a former employee under the False Claims Act. The government alleged that the contractor had circumvented contractually required quality reviews of completed background investigations to increase the company’s revenues and profits. In August 2015, the Department of Justice announced that USIS and its parent company had agreed to a $30 million settlement in exchange for a release of liability under the False Claims Act; accordingly, the claims resolved by the settlement agreement were allegations only, and there was no determination of liability. In June 2015, OPM conducted a review of USIS cases and found that the investigations for which USIS did not conduct the quality review were generally less complex cases. In addition, these cases had a lower return rate from OPM reviewers. In September 2016, OPM awarded new indefinite delivery/indefinite quantity contracts for investigation fieldwork services to four companies— CACI Premier Technology, Inc., KeyPoint Government Solutions, Inc., CSRA LLC, and Securitas Critical Infrastructure Services, Inc. The 2-year base period for these contracts runs to the end of fiscal year 2018, and OPM may exercise three 1-year option periods for each contract, with the first beginning on October 1, 2018. Executive Branch Agencies Have Made Progress Reforming the Security Clearance Process, but Long-Standing Key Initiatives Remain Incomplete Executive branch agencies have made progress in reforming the personnel security clearance process by, for example, issuing guidance, such as Quality Assessment Standards to guide background investigations, updated strategic documents to sustain the momentum of the reform effort, and adjudicative guidelines to establish single, common adjudicative criteria for security clearances. However, agencies face challenges in implementing certain aspects of the 2012 Federal Investigative Standards, including full implementation of continuous evaluation, and the issuance of a reciprocity policy remains incomplete. In addition, while the executive branch has taken steps toward establishing performance measures for the quality of government-wide personnel security clearance investigations, there is no milestone for their completion. The PAC Has Made Progress Reforming the Personnel Security Clearance Process The PAC has made progress in reforming the personnel security clearance process, as demonstrated through actions taken in response to recommendations and milestones outlined in four key reform effort documents: (1) the February 2014 120-day review; (2) the 2015 90-day review; (3) the Insider Threat and Security Clearance Reform cross- agency priority goal quarterly progress updates; and (4) the PAC’s strategic framework for fiscal years 2017 through 2021. 120-day review. According to PAC documentation, as of August 2017, the PAC had implemented 73 percent of the 120-day review recommendations. For example, in response to a recommendation from the review, ODNI and OPM jointly issued Quality Assessment Standards in January 2015, which establish federal guidelines for assessing the quality of national security and suitability investigations. The establishment of the standards is intended to facilitate the measurement and continued improvement of investigative quality across the executive branch. In response to another related recommendation, ODNI developed the Quality Assessment Reporting Tool (QART), through which agencies will report on the completeness of investigations. According to ODNI officials, the QART was implemented in October 2016, and full implementation is expected by the end of calendar year 2017. 90-day review. By January 2017, the PAC had taken steps to implement all of the actions identified in the January 2016 summary of the 90-day review. Specifically, Executive Order 13741, issued in September 2016, established NBIB, within OPM, to replace FIS as the primary executive branch service provider for background investigations. It also identified DOD as the entity responsible for designing, developing, operating, and securing IT systems that support NBIB’s background investigations. Additionally, the Executive Order elevated the Under Secretary of Defense for Intelligence to a full principal member of the PAC and directed the PAC to review and update governance, authorities, roles, and responsibilities. Subsequently, Executive Order 13764, issued in January 2017, further clarified relevant authorities, roles, and responsibilities, among other things. Further, according to PAC Program Management Office officials, the PAC has taken steps to implement continuous process improvements, such as developing a research and innovation program through which it has undertaken a number of projects aimed at improving the personnel security clearance process. In addition, the PAC established a continuous performance improvement initiative to develop mechanisms to improve the quality and efficiency of the end-to- end security, suitability, and credentialing vetting processes. As of July 2017, the PAC had identified seven categories of performance measures for the end-to-end security, suitability, and credentialing processes—such as timeliness, volume, and cost-efficiency—which it planned to implement in a phased approach. Cross-agency priority goal. From the second quarter of fiscal year 2014 through the fourth quarter of fiscal year 2016, the PAC reported quarterly on the status of key initiatives, among other things, as part of the Insider Threat and Security Clearance Reform cross-agency priority goal. For each initiative, the PAC reported the milestone due date, the milestone status—on track, complete, at risk, missed, or not started—and the responsible agencies. As of the PAC’s last publicly reported quarterly update, for the fourth quarter of fiscal year 2016, 8 of 33 initiatives were listed as complete. According to PAC Program Management Office officials, they have continued to track the status of these milestones internally, and almost half of the initiatives—16 of 33—were listed as complete as of the third quarter of fiscal year 2017. These initiatives include the establishment of a Federal Background Investigations Liaison Office within NBIB to oversee and resolve issues between federal, state, and local law enforcement entities when collecting criminal history record information for background investigations, and developing plans to implement improved investigator and adjudicator training. Strategic framework. The PAC has issued three documents that serve as its updated strategic framework for the next 5 years. In July 2016, it issued its Strategic Intent for Fiscal Years 2017 through 2021, which identifies the overall vision, goals, and 5-year business direction to achieve an entrusted workforce. In October 2016, it issued an updated PAC Enterprise IT Strategy, which provides the technical direction to provide mission-capable and secure security, suitability, and credentialing IT systems. According to PAC Program Management Office officials, the third document—the PAC Strategic Intent and Enterprise IT Strategy Implementation Plan (Implementation Plan)—was distributed to executive branch agencies in February 2017. The Implementation Plan documents the key initiatives, targets, and measures for achieving the strategic vision. In March 2009, the Joint Reform Team issued an Enterprise IT Strategy, but the PAC’s own February 2014 120-day review found that this strategy stopped short of actions needed to develop enterprise-wide IT capabilities to modernize, integrate, and automate agency capabilities and retire legacy systems. It further stated that absent a strategy for integrated IT capabilities, agencies created disparate tools designed only to meet their specific requirements and recommended the development and execution of an enterprise reform IT strategy to ensure interoperability and improved sharing of relevant information. We compared the PAC’s 2016 Enterprise IT Strategy against leading practices for comprehensive and effective IT strategies and found that it generally aligns with such practices. For example, it contains results-oriented goals and strategies for agencies to achieve desired results, and describes interdependencies within and across projects. In addition to these four key areas, PAC members noted additional progress in reforming the personnel security clearance process. Specifically, ODNI officials highlighted the development of seven Security Executive Agent Directives, five of which have been issued as of August 2017, related to the use of polygraphs and social media in the investigative process, among other things. For example, in December 2016, the Director of National Intelligence issued Security Executive Agent Directive 4, National Security Adjudicative Guidelines. Effective in June 2017, the directive is meant to establish the single, common adjudicative criteria for all covered individuals who require initial or continued eligibility for access to classified information or eligibility to hold a sensitive position. DOD officials stated that having standardized adjudicative criteria such as these guidelines constitutes an important step in helping to ensure reciprocity. Additionally, a senior PAC Program Management Office official noted that the PAC has designated eight executive branch-wide IT shared service capabilities, such as the electronic adjudication of certain background investigations and a new electronic questionnaire for national security positions. According to this official, the latter two shared services are expected to be rolled out in 2017, with the remaining six shared services being rolled out as they become available. Key Aspects of the 2012 Federal Investigative Standards and the Development of a Reciprocity Policy Remain Incomplete While the PAC has reformed many parts of the personnel security clearance process, implementing certain key aspects of the 2012 Federal Investigative Standards, including changing the frequency of periodic reinvestigations for certain clearance holders and establishing a continuous evaluation program, remain incomplete. In addition, the issuance of ODNI’s draft reciprocity policy has been delayed. 2012 Federal Investigative Standards. These standards outline criteria for conducting background investigations to determine eligibility for a security clearance and are intended to ensure cost-effective, timely, and efficient protection of national interests and to facilitate reciprocal recognition of the resulting investigations. In April 2015, we reported that executive branch agencies with responsibilities for security clearances and suitability determinations had twice approved updated Federal Investigative Standards to replace the 1997 Standards, but that progress in implementing the updated standards had been limited. Specifically, as part of the reform effort that began after the passage of IRTPA, the Director of National Intelligence and the Acting Director of OPM, in their roles as Security and Suitability Executive Agents, signed new Federal Investigative Standards on December 13, 2008, and stated that the anticipated initial deployment of the standards was to begin in the third quarter of fiscal year 2009. However, the 2008 Federal Investigative Standards were not implemented, according to ODNI officials, because key terms were not clearly defined and required further clarification. In December 2012, the Director of National Intelligence and Director of OPM approved updated Federal Investigative Standards. Among other things, the 2012 Federal Investigative Standards identify five investigative tiers. According to OPM Federal Investigations Notice 16-02, tier 3 investigations are required for eligibility for access to secret and confidential information, or for noncritical sensitive positions, or “L” access. OPM Federal Investigations Notice 16-07 indicates that tier 5 investigations are required for eligibility for access to top secret or Sensitive Compartmented Information, or for critical sensitive or special sensitive positions, or “Q” access. The updated standards also changed the frequency of periodic reinvestigations for certain clearance holders. The Federal Investigative Standards milestone for full operating capability is the end of fiscal year 2017. Specific details on this topic were omitted because the information is sensitive. See figure 1 for a timeline of efforts made since 1997 to implement updated Federal Investigative Standards. The 2012 standards include continuous evaluation as a new requirement for certain clearance holders. This is a key executive branch initiative to more frequently identify and assess security-relevant information between periodic reinvestigations. Efforts to implement a continuous evaluation program were included in the implementation documents from the prior reform effort following approval of the 2008 Federal Investigative Standards, including an operational milestone for implementing a continuous evaluation program by the fourth quarter of fiscal year 2010. ODNI has adjusted the milestones for implementing the program and issuing a Security Executive Agent Directive for continuous evaluation several times. For example, in April 2015, we reported that ODNI planned to issue a continuous evaluation policy by September 2016 and to implement a continuous evaluation capability for certain clearance holders by December 2016. However, in November 2017 we found that while ODNI has taken an initial step to implement continuous evaluation in a phased approach across the executive branch, it has not yet issued a Security Executive Agent Directive for continuous evaluation or determined when the future phases of implementation will occur. According to ODNI officials, as of August 2017, this directive was undergoing interagency coordination and would be issued upon completion of that process. As of August 2017, continuous evaluation had not yet been fully implemented and ODNI had not set a new milestone for when it would occur. In November 2017, we recommended, among other things, that the Director of National Intelligence issue a continuous evaluation directive and develop an implementation plan. ODNI generally concurred with those recommendations. Figure 2 provides an overview of the adjusted executive branch milestones for issuing a continuous evaluation policy and implementing a continuous evaluation program, including developing a technical capability. Reciprocity policy. In 2004, IRTPA required that all security clearance background investigations and determinations completed by an authorized investigative agency or authorized adjudicative agency be accepted by all agencies, subject to certain exceptions. As reported in a cross-agency priority goal quarterly update in fiscal year 2016, the milestone for ODNI to issue and promulgate an updated national security reciprocity policy was September 2016. Security clearance reciprocity is statutorily required by IRTPA, subject to certain exceptions, and it is currently implemented by executive orders and guidance across executive-branch agencies. To consolidate existing reciprocity guidance, ODNI planned to issue a comprehensive, national-level security clearance reciprocity policy intended to resolve challenges associated with consistent, timely reciprocity processing across the executive branch. However, the issuance date has been postponed multiple times—the original milestone was September 2013—and as of July 2017, ODNI had not yet issued a reciprocity policy or identified a new milestone for its issuance. In July 2017, ODNI officials stated that a draft reciprocity policy was pending entry into the formal interagency coordination process and would be issued upon completion of that process. However, ODNI officials were unable to provide an estimated issuance date because, according to the officials, the length of the interagency coordination process can vary. PAC Program Management Office officials noted that issuance delays are due, in part, to the development of related personnel security policies, including continuous evaluation, with which the reciprocity policy must be aligned. Figure 3 shows milestones for the issuance of the reciprocity policy. In November 2010, we found that although executive-branch agency officials stated that reciprocity is regularly granted, agencies did not have complete records on the extent to which previously granted security clearance investigations and adjudications are honored government- wide. Further, we found that agencies lacked a standard metric for tracking reciprocity. We recommended that the Deputy Director for Management, OMB, in the capacity as chair of the PAC, develop comprehensive metrics to track when reciprocity is granted and report the findings from the expanded tracking to Congress. OMB concurred with our recommendation. However, in April 2015, we found that executive branch agencies still did not consistently track when reciprocity is or is not granted, nor did they have metrics in place to measure how often reciprocity occurs. ODNI officials stated that they planned to develop them by 2016. Although the Director of National Intelligence had requested Intelligence Community elements take steps to begin capturing reciprocity data in December 2014, such baseline data needed to support measures for reciprocity were not being collected government-wide. We recommended, in 2015, that the Director of National Intelligence require the development of baseline data to support measures for reciprocity. These data would help to identify and monitor changes in reciprocity government-wide. ODNI did not state whether it concurred with the recommendation, and as of November 2017, it had not been implemented. PAC officials stated that the greatest challenge of the reform effort is the breadth and complexity of the issues it is trying to resolve, noting that the reform effort involves nearly every executive branch agency. In addition, these officials stated that sometimes agencies focus on short-term high- visibility issues instead of longer-term efforts, which are needed for systemic change. ODNI officials also noted the complexities of reforming the personnel security clearance process and working toward a whole-of- government solution. These officials noted that the reform efforts involve coordination among a number of agencies across the executive branch, which is both time and resource intensive. Both PAC Program Management Office and ODNI officials also identified limited agency resources and competing priorities—across executive branch agencies— as additional challenges. The PAC has taken recent steps to help address some of these challenges to continued progress, which could facilitate the completion of the key initiatives discussed above. For example, in its Implementation Plan the PAC has identified approximately 50 initiatives on which it will focus its work over the next 5 fiscal years and has aligned those activities with its four strategic categories of initiatives—trusted workforce, modern vetting, secure and modern mission-capable IT, and continuous performance improvement. However, according to ODNI officials, during their review of a draft of the Implementation Plan, they raised concerns about the number of initiatives and highlighted the need to provide greater prioritization of the initiatives to help better focus efforts. For example, some agencies are assigned as a primary owner of multiple initiatives. Specific details of the number of initiatives to which agencies are assigned were omitted because the information is sensitive. PAC Program Management Officials stated that, to alleviate these concerns, they subsequently identified two to four priority initiatives within each of the four categories to help focus agency efforts. These officials further stated that the PAC intends to update and reissue a condensed version of its Implementation Plan annually so that it can make revisions as issues that affect these priorities, such as reduced budgets, occur. These 11 priority initiatives are identified in the PAC’s Implementation Plan which, according to PAC Program Management Office officials, the PAC finalized and circulated to executive branch agencies in February 2017. For example, establishing a continuous evaluation capability and strengthening and aligning guidelines for the reciprocal recognition of existing vetting decisions are listed among the PAC’s priority initiatives. Given the limited agency resources cited by ODNI and PAC Program Management Office officials and other key competing efforts, such as improving investigation timeliness, the PAC’s prioritization of initiatives could help to refocus efforts on the most critical areas of the reform effort, and could provide agencies with a manageable number of initiatives on which to prioritize their efforts. Executive Branch Has Taken Steps to Establish Government-wide Performance Measures for the Quality of Background Investigations, but It Is Unclear When This Effort Will Be Completed Our prior work on personnel security clearances has identified concerns about the quality of background investigations and has highlighted the need to build quality throughout the process for almost 20 years. Additionally, we found that executive branch reports on the personnel security clearance process contained limited information on quality in the process. In May 2009, we recommended, among other things, that the Deputy Director for Management of OMB, in the capacity as Chair of the PAC, include in an IRTPA-required report to Congress quality metrics to provide more transparency on personnel security clearances. OMB concurred with that recommendation. However, the 2010 report to Congress did not include quality metrics, and the IRTPA reporting requirement expired in 2011. Appendix III provides an overview of our work in this area and of executive branch efforts to establish government- wide performance measures for the quality of background investigations. According to Executive Order 13467, the PAC is to establish annual goals and progress metrics related to security and suitability processes and continuous performance improvement. This focus on performance measures is consistent with our body of work on using results-oriented management tools to help achieve desired program outcomes—derived from our work on how to effectively implement the Government Performance and Results Act (GPRA) and the GPRA Modernization Act of 2010. This body of work provides agencies with a framework for effectively managing program performance to achieve desired outcomes, including establishing performance measures. In addition, Standards for Internal Control in the Federal Government states that management should establish and review performance measures and monitor internal control systems. Further, we found in previous work that interim milestones can be used to show progress toward implementing efforts or to make adjustments when necessary. Developing and using specific milestones and timelines to guide and gauge progress toward achieving an agency’s desired results informs management of the rate of progress toward achieving goals, and whether adjustments need to be made in order to maintain progress within given timeframes. As of July 2017, the executive branch had taken two of three steps to establish government-wide measures for the quality of investigations. First, as previously discussed, ODNI and OPM issued Quality Assessment Standards for background investigations in January 2015 to establish standard criteria for agencies to consistently evaluate complete investigations. The standards were developed through an interagency effort chaired by ODNI, OPM, and DOD. These standards define complete investigations as those in which all required components were obtained in full and any known issues—such as criminal activity—were resolved per the standards. DOD officials highlighted issue resolution— having enough useful information about the circumstances surrounding a given issue to make an adjudicative determination—as a persistent challenge with background investigations for personnel security clearances, and as key to determining investigation quality. Second, ODNI developed the QART, through which agencies will be able to report on the completeness of investigations, to include whether adjudicators considered issues identified during an investigation to have been sufficiently resolved. According to ODNI officials, they began to implement the QART in October 2016, and full implementation is expected by the end of calendar year 2017. ODNI officials stated that they are collecting sufficient data from the QART in order to develop measures for the quality of investigations. In ODNI’s review of a draft of this report, officials stated that it is premature to set a milestone for completing government-wide performance measures for the quality of investigations and that ODNI will set such a milestone when the QART data have been fully analyzed. Specific details on this topic were omitted because the information is sensitive. Figure 4 provides an overview of the timeline for the executive branch’s three-step process to develop measures for the quality of investigations. Although ODNI has developed the QART, and ODNI and OPM have issued the Quality Assessment Standards, there are still challenges to resolve as measures for the quality of investigations are established. For example, DOD officials stated that they do not intend for all of their adjudicators to use the QART, and that they have not developed an interface between their Rapid Assessment of Incomplete Security Evaluations system and the QART. DOD officials also stated that they will continue to use their tool until the QART is automated for use in a new Defense Information System for Security. If DOD investigations— which represent the majority of the background investigations conducted by NBIB—are not captured by the QART, it is unclear how ODNI will have sufficient data to develop government-wide measures for the quality of investigations. Further, NBIB officials noted that if their largest customer is not utilizing the QART, they are not positioned to receive comprehensive feedback. In April 2015 we recommended, among other things, that the Director of National Intelligence, in his capacity as Security Executive Agent, develop, implement, and report to Congress on government-wide, results- oriented performance measures for security clearance background investigation quality. ODNI did not state whether it concurred with that recommendation, and the recommendation has not been implemented. We continue to believe that measures for the quality of background investigations are needed to provide decision-makers, including OMB and Congress, with information on the quality of personnel security clearance background investigations, and to help ensure the quality of investigations. Without establishing a milestone for the completion of government-wide performance measures for the quality of investigations, their completion may be further delayed, and executive branch agencies will not have a schedule against which they can track progress or to which they are accountable. Agencies Meeting Timeliness Objectives for Initial Clearances Decreased Since Fiscal Year 2012; a Government-wide Approach Has Not Been Developed to Improve Timeliness; and Reporting Has Been Limited The Number of Executive Branch Agencies Meeting Established Timeliness Objectives for Investigations and Adjudications for Initial Secret and Top Secret Clearances Decreased from Fiscal Years 2012 through 2016 Executive branch agencies have experienced challenges in meeting timeliness objectives for investigation and adjudication of initial personnel security clearances, and their reporting on timeliness has been limited. The number of executive branch agencies meeting established timeliness objectives for both initial secret and initial top secret clearances decreased from fiscal year 2012 through fiscal year 2016. While ODNI has taken steps to address timeliness challenges, it has not developed a government-wide approach to help agencies improve the timeliness of initial personnel security clearances. In addition, the executive branch’s reporting on timeliness has been limited, which inhibits both transparency and oversight of the personnel security clearance process. Our analysis of timeliness data for specific executive branch agencies showed that the percent of agencies meeting established investigation and adjudication timeliness objectives for initial secret and top secret personnel security clearances decreased from fiscal year 2012 through 2016. Specifically, in fiscal year 2012, 27 percent of the agencies for which we obtained data met investigation and adjudication objectives for at least three of four quarters for initial secret clearances, and 59 percent met those objectives for initial top secret clearances. By fiscal year 2016, that decreased to 2 percent and 10 percent, respectively. IRTPA established an objective for each authorized adjudicative agency to make a determination on at least 90 percent of all applications for a personnel security clearance within an average of 60 days after the date of receipt of the completed application by an authorized investigative agency—not longer than 40 days to complete the investigative phase, and 20 days to complete the adjudicative phase. In assessing timeliness under these objectives, executive branch agencies exclude the slowest 10 percent and report on the average of the remaining 90 percent (referred to as the fastest 90 percent). In 2012, ODNI, in coordination with interagency participation, modified the timeliness goals for certain background investigations and established new timeliness goals. As part of the Insider Threat and Security Clearance Reform cross- agency priority goal, from the second quarter of fiscal year 2014 until the fourth quarter of fiscal year 2016, the PAC reported quarterly on the average number of days to initiate, investigate, adjudicate, and complete the end-to-end process for initial secret and initial top secret cases for the executive branch as a whole. It reported this information as compared with the IRTPA-established timeliness objectives for initial secret clearances and ODNI’s revised timeliness objectives for initial top secret clearances. For fiscal year 2016, the PAC reported that the government- wide average for executive branch agencies: Did not meet the 40-day investigation objective for the fastest 90 percent of initial secret clearances for any quarter. The averages ranged from 92 days to 135 days. Did not meet ODNI’s revised investigation objective for the fastest 90 percent of initial top secret clearances for any quarter. The averages ranged from 168 days to 208 days. With regard to the timeliness of investigations, our analysis of timeliness data reported by specific executive branch agencies showed that the percent of agencies that met timeliness objectives decreased from fiscal year 2012 through 2016. Specifically, our analysis showed: While 27 percent of the agencies met the 40-day IRTPA-established investigation objective for at least three of four quarters for the fastest 90 percent of initial secret cases in fiscal year 2012, only 2 percent met the objective for at least three of four quarters in fiscal year 2016. While 78 percent of the agencies met ODNI’s revised investigation objective for at least three of four quarters for the fastest 90 percent of initial top secret cases in fiscal year 2012, only 12 percent met the objective for at least three of four quarters in fiscal year 2016. Across the agencies we reviewed, the average number of days to complete the investigation phase of the fastest 90 percent of initial top secret cases for the fourth quarter of fiscal year 2016 ranged from 26 days to 459 days. Furthermore, our analysis showed that, for the executive branch agencies included in our review, the time required to investigate initial personnel security clearances increased from fiscal year 2012 through fiscal year 2016, often exceeding the investigation phase objective established by IRTPA. In addition, we found that both agencies with delegated authority to conduct their own investigations and those that used FIS (now NBIB) as their investigative service provider experienced challenges in meeting established investigation timeliness objectives. However, the only agencies that met investigation timeliness objectives for at least three of four quarters of fiscal year 2016—for the fastest 90 percent of initial secret and initial top secret clearances—have delegated authority to conduct their own investigations. The executive branch’s challenges in meeting investigation timeliness objectives for initial personnel security clearances have contributed to a significant backlog of background investigations at the primary entity responsible for background investigations, NBIB. NBIB documentation shows that its backlog of pending investigations increased from about 190,000 in August 2014 to more than 709,000 investigations, as of September 2017. NBIB officials stated that more than 70 percent of the bureau’s pending background investigations had been pending for longer than the established timeliness objectives, as of June 2017. Additional details about NBIB’s investigation backlog and actions the bureau is taking to address it are discussed later in this report. With regard to the timeliness of adjudications, our analysis showed: While 51 percent of the agencies met the 20-day adjudication objective for at least three of four quarters for the fastest 90 percent of initial secret cases in fiscal year 2012, only 35 percent met the objective for at least three of four quarters in fiscal year 2016. While 65 percent of the agencies met the 20-day adjudication objective for at least three of four quarters for the fastest 90 percent of initial top secret cases in fiscal year 2012, only 43 percent met the objective for at least three of four quarters in fiscal year 2016. Across the executive branch agencies included in our review, the average number of days to adjudicate the fastest 90 percent of initial top secret cases for the fourth quarter of fiscal year 2016 ranged from 3 days to 175 days. Table 1 shows the percent of agencies meeting the investigation and adjudication objectives for the fastest 90 percent of initial secret and initial top secret cases for at least three of four quarters from fiscal years 2012 through 2016. In November 2017, we reported that the percent of executive branch agencies meeting established timeliness goals for completing periodic reinvestigations also decreased from fiscal years 2012 through 2016. Appendix IV provides information on executive branch agency periodic reinvestigations from fiscal years 2012 through 2016. ODNI Has Taken Steps to Address Timeliness Challenges but Has Not Developed a Government- wide Approach to Help Improve Timeliness ODNI has taken steps to address challenges in meeting established timeliness objectives, such as revising the timeliness objective for top secret investigations in 2012; however, it has not developed a government-wide approach to help agencies improve the timeliness of initial personnel security clearances. ODNI officials stated that several significant events contributed to agency challenges in meeting timeliness objectives over the past 5 fiscal years, including a government shutdown, the 2015 OPM data breach, a loss of OPM contractor support, and OPM’s review of the security of its IT systems, which resulted in the temporary suspension of the web-based platform used to complete and submit background investigation forms. In addition, executive branch agencies noted the increased investigative requirements stemming from the 2012 Federal Investigative Standards as a further challenge to meeting established timeliness objectives in the future. Standards for Internal Control in the Federal Government states that management evaluates and, if necessary, revises defined objectives so that they are consistent with requirements and expectations. In addition, the standards state that management should use quality information to achieve the entity’s objectives, including relevant data from internal and external sources. As previously discussed, ODNI, in coordination with interagency participation, modified the timeliness goals for certain background investigations and established new timeliness goals. Since then, meeting timeliness objectives has become even more challenging due, for example, to updated investigation standards. However, since 2012, ODNI has not revisited the investigation or adjudication timeliness objectives for secret and top secret clearances. Specifically, ODNI has not conducted an evidence-based review, using relevant data, to ensure that these objectives are appropriate, given changes to the investigative requirements and other stated challenges. In addition, while ODNI and interagency partners modified certain timeliness goals in 2012, the number of executive branch agencies able to consistently meet the revised objectives also decreased over the past 5 fiscal years. Without conducting an evidence-based review of the investigation and adjudication timeliness objectives for both secret and top secret clearances to ensure that they are appropriate, agencies may experience further timeliness challenges and delays in determining eligibility. According to ODNI officials, they are aware of each agency that does not meet timeliness objectives and, in the capacity as Security Executive Agent, the Director of National Intelligence has taken steps to help these agencies improve their timeliness. Specifically, ODNI officials stated that the Director of National Intelligence issues annual agency performance letters to heads of agencies when security clearance timeliness objectives are not met. In the letters, the Director of National Intelligence requests that the agency submit an action plan, within 60 days of the date of the letter, identifying the factors that prevented the agency from meeting established timeliness objectives and the actions the agency will take to remedy those impediments. Officials stated that since the letter comes directly from the Director, this helps to attract the maximum amount of attention possible. In addition to establishing the current timeliness objectives for initial security clearances, IRTPA also established a 5-year timeframe and an interim milestone for the executive branch to implement those objectives. Specifically, the act required the development of a plan to reduce the length of the personnel security clearance process, including the IRTPA- established timeliness objectives described above. The plan was to be developed in consultation with appropriate committees of Congress and each authorized adjudicative agency, and to take effect 5 years after the date of enactment. Beginning no later than 2 years after the enactment of IRTPA and ending on the date the plan took effect, authorized adjudicative agencies were to make a determination on at least 80 percent of all applications within an average of 120 days after receipt by an authorized investigative agency—not longer than 90 days to investigate and 30 days to adjudicate. In November 2005, the executive branch submitted a plan to improve the timeliness of personnel security clearance processes government-wide. The Joint Reform Team submitted its first reform plan to the President on April 30, 2008, which proposed a new process for determining clearance eligibility. Standards for Internal Control in the Federal Government establishes that management should define objectives clearly to enable the identification of risks and define risk tolerances. In our prior work on interagency collaboration, we found that overarching plans can help agencies overcome differences in missions, cultures, and ways of doing business, and help agencies better align their activities, processes, and resources to collaborate effectively to accomplish a commonly defined outcome. Additionally, to help sustain and enhance collaboration among federal agencies, we found that agencies that create a means to monitor, evaluate, and report the results of collaborative efforts can better identify areas for improvement. Further, we have found in previous work, including our prior work on personnel security clearances, that interim milestones can be used to show progress toward implementing efforts or to make adjustments when necessary. Developing and using specific milestones to guide and gauge progress toward achieving an agency’s desired results informs management of the rate of progress toward achieving goals, and whether adjustments need to be made in order to maintain progress within given time frames. While ODNI requests individual corrective action plans from agencies not meeting security clearance timeliness objectives, the executive branch has not developed a government-wide plan, with goals and interim milestones, to meet established timeliness objectives for initial security clearances that takes into consideration increased investigative requirements and other stated challenges. A coordinated approach, in addition to the ODNI-requested agency-specific plans, could help to improve timeliness, given that: (1) both agencies that use NBIB as their investigative service provider and those that have delegated authority to conduct their own investigations have experienced challenges in meeting established investigation and adjudication timeliness objectives over the past 5 fiscal years; and (2) timeliness challenges include government- wide challenges, such as the increased requirements stemming from the 2012 Federal Investigative Standards and past challenges in relation to OPM contractor support, as discussed above, and not just agency- specific challenges, such as staffing shortfalls. While the individual agency action plans represent a positive step toward helping to improve timeliness, agencies across the executive branch continue to experience timeliness challenges. A government-wide plan would better position ODNI to identify and address any systemic issues. Without a government- wide plan, including goals and interim milestones, for achieving timeliness objectives for initial secret and top secret investigations and adjudications—similar to the plan previously required by IRTPA—there could be continued delays in determining individuals’ eligibility for access to classified information. Ultimately, such delays may leave agencies unable to fill critical positions that require a security clearance. Current Timeliness Reporting Provides Limited Transparency and Oversight of the Reform Effort Since 2011, the executive branch’s reporting on the timeliness of personnel security clearances has provided limited transparency and oversight of the overall reform effort. Specifically, IRTPA required the executive branch to submit an annual report, through 2011, to the appropriate congressional committees on the progress made toward meeting the act’s requirements, including timeliness data and a discussion of any impediments to the smooth and timely functioning of its requirements. With respect to timeliness data, the act required that those reports include the periods of time required by the authorized investigative agencies and authorized adjudicative agencies for conducting investigations, adjudicating cases, and granting clearances, from date of submission to ultimate disposition and notification to the subject and the subject’s employer. In response to this requirement, the executive branch provided a series of reports from 2006 through 2011 on the timeliness of executive branch agencies’ initial investigations and periodic reinvestigations. For example, ODNI’s IRTPA Title III Annual Report for 2010 specified the average number of days by quarter it took for selected individual agencies to initiate, investigate, adjudicate, and complete the end-to-end process for the fastest 90 percent of security clearances. The report also included average timeliness data for the executive branch as a whole. However, since the IRTPA requirement ended in 2011, executive branch reporting has been limited. For example, as previously discussed, the PAC did not begin its quarterly reporting on the timeliness of executive branch agencies’ personnel security clearances until the second quarter of fiscal year 2014 through the Insider Threat and Security Clearance Reform cross-agency priority goal. In addition, while these reports include the timeliness of both initial investigations and periodic reinvestigations, they provide the average timeliness of the executive branch as a whole and not the timeliness of individual executive branch agencies—as was provided under the prior IRTPA reporting—which makes it difficult to identify specific agencies that may be experiencing challenges. Additionally, the Intelligence Authorization Act for Fiscal Year 2010 requires the President to submit an annual report on security clearance determinations to Congress. Among other things, the report is to include, for the preceding fiscal year, the number of federal and contractor employees who held a security clearance at each level and the number of employees who were approved for a security clearance at each level, as well as in-depth security clearance determination timeliness information for each element of the intelligence community. However, the annual reports that ODNI provides to the congressional intelligence committees in response to this requirement include only limited data as compared with reports that were completed in response to IRTPA. Specifically, the Intelligence Authorization Act for Fiscal Year 2010 requires information on the total amount of time for the longest and shortest determinations, and the age of pending investigations, not average timeliness. The reports are also limited in that they capture data for only a portion of the intelligence community. Specifically, ODNI’s 2015 Annual Report on Security Clearance Determinations states that the report includes information for 7 of 15 elements of the intelligence community and that the other 8 elements reported that collecting the information would be a manual, resource-intensive process that was not viable due primarily to technology restrictions. Standards for Internal Control in the Federal Government states that management should externally communicate the necessary quality information to achieve the entity’s objectives through reporting lines so that external parties can help the entity achieve its objectives and address related risks. In addition, our high-risk criteria for monitoring and demonstrated progress call for agencies to report on program progress and related risks as well as show that issues are being effectively managed. However, since the IRTPA annual reporting requirement ended in 2011, the executive branch has provided limited reporting on the timeliness of individual agencies’ initial investigations or periodic reinvestigations for personnel security clearances. In addition, while the PAC had regularly reported publicly on timeliness for the executive branch as a whole on a quarterly basis, it has not provided a public quarterly status update since the fourth quarter of fiscal year 2016. According to performance.gov, the website through which the PAC distributes its quarterly updates, the content—including the PAC’s quarterly updates—is undergoing an overhaul as agencies develop updated goals and objectives for release in February 2018 with the President’s next budget submission to Congress. It is unclear whether the new administration will continue to designate personnel security clearance reform as a cross-agency priority goal. PAC Program Management Office officials stated that they continue to track and report this information internally within the executive branch. These officials stated that they were uncertain as to whether performance.gov would remain a vehicle by which they would report on the status of the reform effort, including executive branch-wide timeliness. However, the officials also stated that it is important for the information to be reported in order to maintain transparency and the momentum of the reform effort. Without transparent reporting by the executive branch on investigation and adjudication timeliness for both initial investigations and periodic reinvestigations, Congress will not be able to effectively execute its oversight role and monitor individual executive branch agency progress in meeting timeliness objectives. In addition, the absence of comprehensive reporting on personnel security clearance timeliness limits the ability of congressional decision makers to thoroughly evaluate and precisely identify where and why delays exist within the process, as well as to identify corrections as necessary. In addition, should the PAC’s quarterly progress updates be suspended indefinitely, Congress and the public will have limited transparency into the status of key reform effort initiatives, which may delay the timely identification of problems, and ultimately disrupt the momentum of the reform effort as a whole. NBIB Has Taken Steps to Improve the Background Investigation Process but Faces Operational Challenges in Addressing the Investigation Backlog and Workforce Planning The transition from FIS to NBIB has involved organizational changes intended to improve the background investigation process, but the bureau faces operational challenges in addressing the investigation backlog and associated workforce planning. NBIB’s organizational changes include the creation of some new departments, and DOD is now responsible for designing, developing, and maintaining a new IT system for the bureau, but must contend with risks posed by vulnerabilities in OPM’s legacy IT systems, which NBIB still utilizes. As NBIB transitions, it has taken steps to improve its oversight of background investigations contracts and measure the completeness of background investigations; however, it faces operational challenges in developing a plan to reduce the size of the investigation backlog to a manageable level and in ensuring that its overall workforce is sized and structured to meet its mission. Establishment of NBIB Involved Organizational Changes, the Designation of Oversight Roles, and Transfer of IT Responsibilities to DOD The transition from FIS to NBIB involved some organizational changes, such as the creation of new departments designed to enhance information sharing and contract oversight, among other things. NBIB also made changes to existing departments, such as enhancing its counterintelligence division to foster greater collaboration with the intelligence community. In addition, NBIB is subject to oversight from multiple entities, such as OPM, ODNI, and the PAC. Further, DOD is now responsible for designing, developing, and maintaining a new IT system for NBIB that can provide increased security. However, vulnerabilities in OPM’s legacy systems pose risks to the security of the new system and could delay its implementation. Transition from FIS to NBIB Involved Changes to Organizational Structure NBIB was established to replace FIS, and the transition has involved changes to the organizational structure. In response to the results of 90- day review that were announced in January 2016, in September 2016, Executive Order 13741 amended Executive Order 13467 to establish the roles and responsibilities of NBIB within OPM and made the Director of NBIB a member of the PAC. According to Executive Order 13467, as amended, NBIB is to serve as the primary executive branch service provider for background investigations for, among other things, eligibility for access to classified information; eligibility to hold a sensitive position; suitability or fitness for government employment; and authorization to be issued a federal credential for logical and physical access to federally controlled facilities or information systems. Among other things, the bureau is to also provide effective, efficient, and secure personnel background investigations for the federal government. When announcing the establishment of NBIB, in January 2016, the administration reported the intention to create a dedicated transition team headquartered in Washington, D.C., to develop and implement a transition plan to: (1) stand up the bureau; (2) ensure that the transition timeline fully aligns with business needs; (3) transition the management of FIS IT systems to DOD; (4) migrate the existing mission, functions, personnel, and support structure of FIS to NBIB; and (5) provide continuity of service to customer agencies during the transition. According to its charter, the transition team was composed of current OPM employees, and federal employees detailed or assigned to OPM or DOD from other executive branch agencies and departments. NBIB officials noted that employees from across the executive branch with relevant experience and qualifications were recruited to ensure that stakeholder agencies’ equities were represented, and that the transition team leader was recruited from outside of OPM and reported directly to the OPM Director throughout the transition process. OPM reported that NBIB became operational on October 1, 2016, but that the complete transition will take some time. For example, the transition plan specifies activities throughout fiscal year 2017 and into fiscal year 2018 to implement the transition from FIS to NBIB. NBIB officials said they expect that the bureau will have migrated to the new organizational structure substantially by mid-2018. The transition also involved some organizational changes intended to streamline certain business processes or more effectively manage background investigations as the organization has continued to evolve. NBIB officials stated that the transition team established the organizational structure by assessing essential FIS functions in coordination with key community stakeholders—including new and external customers—through the PAC as well as FIS personnel. The officials said that the transition team then linked similar functions and interdependencies to establish each of the offices. Additionally, NBIB officials stated that the 2015 90-day review helped to determine the organizational structure because it identified a need for a business process reengineering analysis. Through its establishment, NBIB absorbed FIS and assumed its mission. NBIB’s organizational structure has several changes from the structure of FIS, to include the establishment of the following four new departments: 1. Federal Investigative Records Enterprise. The functions of this department include a new law enforcement and records outreach group to improve outreach and more effectively collect information with state and local law enforcement offices. 2. Policy, Strategy and Business Transformation. The functions of this department include expanding existing performance reporting to incorporate metrics regarding effectiveness; and researching and identifying systemic issues in workload, processes, and products to determine where process improvement could be achieved. 3. Contracting and Business Solutions. The functions of this department include enhancing and consolidating administration of NBIB contracts to provide consistent oversight. 4. Information Technology Management Office. The functions of this department include supporting the delivery and enhancement of quality IT systems to NBIB in a timely and effective manner, gathering and communicating needs and requirements for new applications, and coordinating implementation of changes to current systems. In addition to the creation of these new departments, NBIB also made changes to several other departments from FIS. For example, according to NBIB documents, the Field Operations department added a “Field Contracts” division that is designed to oversee and monitor the contractor workforce performing background investigations, to ensure quality and timely products. This department also enhanced its counterintelligence division to focus on counterintelligence and insider threat support and to foster greater collaboration with the intelligence community. Further, NBIB created a new financial office to oversee budgeting, pricing and funding models, financial reporting, data accuracy, and internal controls monitoring. Moreover, NBIB created a new Integrity Assurance, Compliance, and Inspection division by merging the FIS Integrity Assurance and Inspection divisions to streamline similar functions and improve processes and efficiencies. Executive Order 13741 provided some guidelines governing the structure and location of NBIB. Specifically, it required that NBIB be headquartered in or near Washington, D.C., and that NBIB have dedicated resources, including but not limited to a senior privacy official. NBIB’s headquarters is located in Washington, D.C., but according to NBIB officials, as of July 2017, only 48—including both occupied and vacant positions—of NBIB’s 3,260 positions, or about 1.5 percent, were located in Washington, D.C. In addition, although the position of the senior privacy official has been established in the NBIB organization chart, according to NBIB officials, this position had not been filled as of July 2017. NBIB officials explained that they work closely with OPM’s senior privacy officer, and so they decided to prioritize filling other leadership positions within NBIB. NBIB Subject to Oversight from OPM, ODNI, and the PAC NBIB is subject to oversight from multiple entities, such as OPM, ODNI, and the PAC. Executive Order 13741 provided that the bureau would be established within OPM. NBIB officials stated that the bureau is part of OPM and is governed in a manner consistent with its other operational components. They also said that although the structure of NBIB is different from that of FIS, its general relationship with OPM and its leadership reporting chain are similar. Specifically, comparing the organizational charts of FIS and NBIB, FIS was led by an Associate Director who reported to the Director of OPM, while NBIB is led by a Director who reports to the Director of OPM. According to NBIB, the OPM Director has delegated certain authorities to NBIB; additionally, the OPM Senior Procurement Executive delegated to NBIB certain administrative and acquisition authorities. NBIB officials said that this makes its structure more flexible. NBIB officials said that where support is provided from other OPM offices—such as communications, legislative affairs, legal, procurement, security, facilities, and the office of the Chief Information Officer—there is continual dialogue between that office’s leadership and the staff directly supporting the bureau. The officials also noted a variety of regular meetings, such as a weekly meeting between the Acting Director of OPM and the NBIB Director and Chief of Staff, attendance at daily OPM senior staff meetings, and briefings every other month with the OPM Inspector General, among others. In addition, as previously discussed, as the Security Executive Agent, the Director of National Intelligence is responsible for various matters related to security clearance investigation oversight, programs, policies, and processes. Executive Order 13467, as amended by Executive Orders 13741 and 13764, provides that NBIB, through the Director of OPM, is subject to the oversight of the Security Executive Agent with respect to the conduct of investigations for eligibility for access to classified information or to hold a sensitive position. Similarly, Executive Order 13467, as amended, provides that NBIB is responsible for conducting background investigations in accordance with policies, procedures, standards, and requirements established by the Security Executive Agent and Suitability Executive Agent. In February 2017, the Acting Director of OPM testified that the bureau has been working closely with ODNI to identify policy and process changes to address the investigation backlog. NBIB officials stated that the bureau and ODNI are active partners, and that the bureau participates in many of ODNI’s working groups in the development of policies or processes related to personnel security clearances. In addition, the officials said that the bureau reports timeliness, quality, and performance metrics to ODNI on no less than a quarterly basis, and that its personnel collaborate with ODNI on reviews of processes, such as those related to social media, continuous evaluation, insider threat, and counterintelligence. ODNI officials told us that in its oversight role of NBIB, ODNI collects quarterly timeliness data and requests that agencies using NBIB as their investigative service provider enter the investigations into the QART to assess the quality of the investigations. Further, Executive Order 13467, as amended by Executive Order 13741, describes an oversight relationship between the PAC and NBIB. It requires the PAC to hold NBIB accountable for the fulfillment of the bureau’s responsibilities set out in the Executive Order. It further provides that NBIB is to provide the PAC with information, to the extent permitted by law, on matters of performance, timeliness, capacity, IT modernization, continuous performance improvement, and other relevant aspects of NBIB operations. PAC Program Management Office officials told us that they worked with NBIB during the transition from FIS and answered a lot of questions, and have helped to fill in staffing and organization holes that were identified by the transition team. DOD Is Building and Managing a New Security Clearance IT System for NBIB, but Security Concerns May Delay Planned Milestones for the New System Executive Order 13467, as amended, assigns the Secretary of Defense the role of developing and securely operating IT systems that support all background investigation processes conducted by NBIB. According to officials from the Office of the DOD Chief Information Officer (CIO), NBIS will be built to NBIB specifications, and OPM will remain the owner of the data and processes. In testimony before the House Oversight and Government Reform Committee in February 2017, the DOD CIO estimated that NBIS would have several “prototype” capabilities by the end of fiscal year 2017, and an initial capability covering the full investigative process sometime in the fourth quarter of 2018. According to DOD officials, full capability for NBIS is scheduled for some time in 2019. However, a NBIB official noted the existence of challenges regarding the IT infrastructure and stated that it is more realistic for NBIS to be fully operational in 2020. According to DOD CIO officials, unexpected complications have arisen since beginning development of NBIS. Specifically, these officials stated that they have discovered that NBIS may require many more inter- connections to OPM legacy systems than originally planned. According to these officials, NBIB will continue to rely on OPM legacy systems for investigations of any complexity until NBIS becomes fully operational. Further, according to DOD CIO officials, when the executive branch begins to use NBIS, complex background investigations would begin in NBIS’s electronic application, but would then need to pass through or draw data from multiple OPM legacy systems before returning to NBIS for adjudication. According to DOD CIO officials, since OPM has 43 back- office functions fed by various systems that are often inter-related, a simple one-to-one system swap of NBIS for an OPM legacy system is not feasible. DOD CIO officials stated that the project management team building NBIS is currently working to fully understand how OPM’s various back-office functions are tied together, and also evaluating the cyber- security risks inherent in connecting to OPM’s legacy systems. DOD CIO officials explained that this connection, as well as logistical challenges associated with data migration from the legacy systems to NBIS, raises concerns about risks to NBIS. Until these risks are properly evaluated, any connection to the legacy systems could present vulnerabilities, according to DOD CIO officials. OPM officials disagreed, stating that OPM and DOD already have IT connection points with the OPM legacy systems, and that the security of OPM’s systems and data continues to be an OPM priority. Securing the legacy systems will be a joint effort by DOD and OPM, according to an October 2016 Memorandum of Agreement between the two agencies regarding the roles, responsibilities, and expectations of each party throughout the entire lifecycle of OPM’s use of DOD’s IT systems in support of the background investigation process. Under the agreement, OPM will retain ownership and responsibility for the operation and performance of all system authorization activities for OPM legacy systems throughout their lifecycle. The agreement provides that OPM will maintain security documentation and information and interconnection exchange agreements, own control selection and security role assignment processes, and perform risk executive functions. The memorandum further states that the security of the legacy OPM IT environment will be a joint effort between OPM and DOD, with DOD assisting in a comprehensive security assessment of all OPM legacy IT systems and related infrastructure on a reimbursable basis. According to DOD CIO and NBIB officials, there is close coordination on a technical level between the two agencies on securing the OPM legacy systems used by NBIB. The officials said that weekly coordination meetings are held between the two agencies, and that DOD has embedded staff at OPM who are under the direct supervision of the OPM CIO. Both GAO and the OPM Inspector General have raised concerns on multiple occasions about various aspects of IT security at OPM, including OPM legacy systems used by NBIB. For example, in August 2017, we reported on OPM’s progress in implementing 19 recommendations made by the United States Computer Emergency Readiness Team to bolster its information security practices and controls in the wake of the 2015 breaches. We found that, as of May 2017, OPM had fully implemented 11 of the recommendations. For the remaining 8 recommendations, actions for 4 were still in progress, and for the other 4, OPM indicated it had completed actions to address them, but we noted further improvements were needed. We further reported that since the 2015 data breaches, which included a compromise of OPM’s systems and files related to background investigations for 21.5 million individuals, OPM has made progress in improving its security to prevent, mitigate, and respond to data breaches involving sensitive personal records and background investigations information. However, we also found that OPM did not effectively monitor actions taken to remediate identified weaknesses. OMB requires agencies to create a Plan of Action and Milestones to track efforts to remediate identified weaknesses, such as those leading to the 19 recommendations made by the United States Computer Emergency Readiness Team. In addition, OPM’s policy requires that scheduled completion dates be included in the plan. The policy also requires a system’s Information System Security Officer to develop a weakness closure package containing evidence of how an open Plan of Action and Milestones has been remediated before the issue, or recommendation in this case, can be closed. Although OPM has a Plan of Action and Milestones to address the 19 recommendations, we found that it had not validated actions taken in a timely manner or updated completion dates in the plan. Because the United States Computer Emergency Readiness Team recommendations are intended to improve the agency’s security posture, we recommended that more timely validation of the effectiveness of the actions taken is warranted. Until closure packages are created and the evidence of such actions is validated, OPM has limited assurance that the actions taken have effectively mitigated vulnerabilities that can expose its systems to cybersecurity incidents. Additionally, in May 2016 we reported on the implementation of OPM’s information security program and the security of selected high-impact systems. We found that OPM, one of four agencies reviewed, had implemented numerous controls to protect selected systems, but that access controls had not always been implemented effectively. We reported that weaknesses also existed in patching known software vulnerabilities and planning for contingencies, and that an underlying reason for these weaknesses was that OPM had not fully implemented key elements of its information security program. We recommended that OPM fully implement key elements of its program, including addressing shortcomings related to its security plans, training, and system testing. According to OPM officials, the agency is taking actions to address these recommendations. In August 2016, we issued a restricted version of our May 2016 report that identified vulnerabilities specific to each of the two systems we reviewed and made recommendations to resolve access control weaknesses in those systems. In December 2016, OPM indicated its concurrence with the recommendations and provided timeframes for implementing them. OPM officials expressed concern that the information from our 2016 reports was now dated, stating that it no longer reflects the current security posture at OPM, and said that they had taken actions to address these recommendations. However, all of the recommendations directed to OPM from the two reports remained open as of November 2017. We had not received any documentation regarding these actions as of November 2017 and thus could not validate the extent that any of these recommendations have been addressed. OPM’s Office of the Inspector General has also raised related concerns, most recently in its October 2017 report on OPM’s security program and practices. Overall, the OPM Inspector General found that OPM’s cybersecurity maturity level was measured at a level 2, “Defined”, meaning that its policies, procedures and strategy were formalized and documented but were not consistently implemented. According to the report, OPM has made improvements in its security assessment and authorization program, and its previous material weakness related to authorizations is now considered a significant deficiency for fiscal year 2017. The report noted that there are still widespread issues related to system authorizations, primarily related to documentation inconsistencies and incomplete or inadequate testing of the systems’ security controls. In addition, the report identified a significant deficiency in OPM’s information security management structure, and found that OPM was not making substantial progress in implementing prior Inspector General recommendations. The report noted that OPM had only closed 34 percent of its findings issued in the past 2 years. In addition to these IT security concerns, funding uncertainties have also complicated the development of NBIS. The President’s fiscal year 2017 budget included $95 million for the development of the system; however, according to DOD CIO officials, of the $95 million that was appropriated, DOD had provided only $31 million for NBIS as of June 2017. According to DOD CIO officials, the fiscal year 2017 continuing resolution had complicated decisions about the funding and disbursement schedule with consequences for planning and the apportioning of resources. A draft funding profile covering fiscal years 2017-2023 estimates funding needs of $175.7 million for research, development, test and evaluation, and $709.4 million for operation and maintenance, over this 7-year period, for a total of $885.2 million. NBIB Has Taken Steps to Improve Operations but Faces Workforce Challenges As NBIB transitions, it has taken steps to improve its operations but continues to face workforce challenges that may hinder its ability to address the backlog of investigation cases and strengthen the background investigation process. The bureau has taken positive steps to improve its oversight of background investigation contracts, including changing contract oversight processes and measuring the completeness of background investigations. However, it faces operational challenges in developing a plan to reduce the size of the investigation backlog and in ensuring that its overall workforce is sized and structured to address it. OPM Has Taken Steps to Improve Oversight of Background Investigation Contracts Contractors are responsible for about 60 percent of NBIB’s background investigation fieldwork, according to NBIB officials. Since 2014, OPM has taken steps to improve its oversight of contracts. NBIB officials stated that changes were made in response to OPM Inspector General recommendations, and that some others were made in response to lessons learned after issues that led to the loss of OPM’s largest fieldwork contractor in 2014. These changes included (1) having federal employees review all background investigation reports, (2) increasing the number of individuals responsible for monitoring contractors’ compliance with contractually established requirements, and (3) establishing a contracting activity within NBIB. Since February 2014, federal employees have reviewed 100 percent of background investigation reports produced by contractors. In contrast, prior to February 2014, federal employees at FIS or a support contractor would review a subset of all of the investigations before releasing them to the respective customer agencies for adjudication. As currently structured, NBIB officials stated that there are now about 350 federal employees within NBIB’s Quality Oversight department who conduct these reviews for both contractor- and federal investigator-conducted cases to determine whether an investigation meets investigative standards for completeness before being released to the customer agency for adjudication. Using an internal database, OPM reviewers identify what, if any, elements of the investigative reports are incomplete and do not meet standards, and they return cases to the investigators for rework as necessary. When OPM reviewers determine that a case meets investigative standards, they close the case and submit it to an adjudicator. Contractors are evaluated for quality performance based on the number of times a case is returned by OPM reviewers for rework as a percentage of the total number of cases completed. According to NBIB data from its internal quality database, the percentage of cases conducted by contractors requiring rework decreased between the last quarters of fiscal years 2014 and 2016 from about 6 percent to 3.2 percent. According to NBIB officials, in 2014, OPM established an independent inspections branch to help the agency’s contracting officer’s representatives (CORs) oversee the background investigation fieldwork contracts. CORs, who are designated in writing by contracting officers, assist in the technical monitoring or administration of a contract. Under NBIB’s current background investigation fieldwork contracts, the COR provides technical direction and control during contractor performance, monitors contract progress, and determines for payment approval purposes whether performance is acceptable with respect to content, quality of services and materials, cost, and timeliness. NBIB officials stated that prior to the establishment of the inspections branch, the CORs were responsible for monitoring all aspects of contract compliance as well as a range of administrative duties, such as tracking performance data, IT support, and billing. Under the current NBIB structure, 16 inspectors in the Integrity Assurance, Compliance and Inspections division focus on contract oversight, according to NBIB officials. In addition to the inspectors, the officials said that there are 17 CORs—one in the Integrity Assurance, Compliance and Inspections division and 16 in the Field Operations department. Additionally, according to NBIB officials, FIS, NBIB’s predecessor, did not have its own contracting division, and instead relied on OPM’s centralized Office of Procurement Operations for contracting support. NBIB’s new organizational structure includes a Contracting and Business Solutions department. According to NBIB officials, they filled the new Head of Contracting Activity position in January 2017. NBIB officials stated that OPM established this new position and department in an effort to strengthen the bureau’s contracting function by creating dedicated positions more narrowly focused on overseeing the contracting function for background investigations and support services. NBIB Has Taken Steps to Measure Completeness of Background Investigations NBIB has developed quality assurance processes and tools to measure the completeness of its investigations. Specifically, NBIB has developed an internal quality database through which federal case reviewers can determine the completeness of investigations, in accordance with investigative standards, that are being produced by both its federal and contract investigators, and can rate cases as either “meets standards” or “below standards.” Cases that are marked as “below standards” are returned to the contractor for rework prior to being finalized and sent to the customer for adjudication. NBIB then monitors, through its Key Performance Indicators, the percentage of investigations that are returned by customer agencies and that NBIB agrees require additional work. Our prior work found that relying on agencies to provide information on investigation quality, by itself, may not provide an accurate reflection of the quality of background investigations. We have reported in the past that officials from several agencies have stated that to avoid further costs or delays, agencies often choose to perform additional steps internally to obtain missing information, clarify or explain issues identified in investigative reports, or gather evidence for issue resolution or mitigation. As recently as July 2017, DOD officials stated that issue resolution was still a concern for them. However, NBIB officials stated that they conduct background investigations in accordance with the Federal Investigative Standards, and that while adjudicators may want more or different details, these are considered outside the scope of background investigations, but can be provided on a case-by-case basis. NBIB Leadership Has Not Developed a Plan to Reduce the Investigation Backlog NBIB leadership has not developed a plan to reduce the size of the investigation backlog to a manageable level. NBIB’s Key Performance Indicators report states that a “healthy” inventory of work, representing approximately 6 weeks of work and allowing NBIB to meet timeliness objectives, is around 180,000 pending investigations. According to NBIB, the backlog of pending investigations increased from about 190,000 in August 2014, before OPM decided not to exercise subsequent option periods for its largest investigative fieldwork contract at the time, to more than 709,000 investigations as of September 2017, as shown in figure 5. NBIB estimated the backlog grew at an average rate of about 3,600 investigations each week from October 2016 through July 2017. As we reported when placing DOD’s personnel security clearance program on the high-risk list, problems related to backlogs and the resulting delays in determining clearance eligibility and issuing initial clearances can result in millions of dollars of additional costs to the federal government, longer periods of time needed to complete national security-related contracts, lost opportunity costs if prospective employees decide to work elsewhere rather than wait to get a clearance, and diminishing quality of the work because industrial contractors may be performing government contracts with personnel who have the necessary security clearances but are not the most experienced and best-qualified personnel for the positions involved. Delays in renewing previously- issued clearances can lead to heightened risk of national security breaches because the longer individuals hold a clearance, the more likely they are to be working with critical information and systems. As the backlog has grown, NBIB has taken steps to increase its capacity to conduct background investigations by increasing its own investigator staff as well as awarding new contracts, effective in December 2016, to four contractors for investigation fieldwork services. NBIB officials said that NBIB has a goal to increase its total number of investigators—federal employees and contractors—to about 7,200 by the end of fiscal year 2017. Specifically, to help address the backlog, NBIB officials reported that NBIB increased its authorized federal investigator workforce by adding 400 federal investigator positions in fiscal year 2016 and 200 positions in fiscal year 2017—an increase from 1,375 to 1,975 authorized positions. As of July 2017, NBIB had filled 1,620 of the 1,975 positions, and 1,513 of its federal investigators were fully trained. NBIB officials explained that they do not plan to increase the federal investigator capacity beyond the currently approved 1,975 because they do not have the ability to absorb more staff. According to the officials, new investigators must be trained by experienced investigators which reduces the amount of time the experienced investigators have to conduct investigative work. When estimating federal investigator capacity, NBIB assumes it will have 277 full-time equivalent vacancies at any given time due to high attrition rates. Further, NBIB officials could not project the federal investigator workforce past April 2018 due to high attrition rates. Given challenges with increasing its federal investigative staff, NBIB continues to rely on contractors to conduct the majority of investigations. NBIB officials noted that contractors perform about 60 percent of NBIB’s total investigative cases. OPM awarded four new investigative fieldwork services contracts that became effective in December 2016—two to incumbent contractors and two to new vendors. In July 2017, OPM officials told us that the contractor and federal staff capacity they currently possess enables them to complete a sufficient number of investigations to prevent the number of pending investigations from increasing further. However, they acknowledged that the four contracts and federal investigator staff do not currently provide OPM enough capacity to reduce the pending number of investigations to the “healthy” inventory level of 180,000 cases. NBIB officials have conducted analyses to determine how changes in the total number of investigators could affect the backlog over time, accounting for current and projected investigator capacity, prior time studies, historical data, geographic location, and other factors. Specifically, NBIB officials assessed four scenarios, from the status quo— assuming no additional contractor or federal investigator hires—to an aggressive contractor staffing plan beyond January 2018, but in July 2017 they determined that the aggressive plan was not feasible. The two scenarios that NBIB identified as most feasible would not result in a “healthy” inventory level until fiscal year 2022 at the earliest. For example, under one scenario, each contractor would increase investigator capacity under current staffing projections through early 2018. Assuming that the contractors adhere to these projections, NBIB would have the capacity to address incoming cases and begin to reduce the backlog, but the backlog would not reach a “healthy” inventory level until sometime after fiscal year 2022. However, NBIB leadership has not determined whether the costs and benefits of any one scenario are preferable to the costs and benefits of the others. Standards for Internal Control in the Federal Government establishes that management should clearly define objectives to enable the identification of risks and define risk tolerances. In addition, our high-risk criteria for capacity call for agencies to ensure they have the capacity, in terms of people and resources, to address and resolve risks. We have also found in previous work that milestones can be used to show progress toward implementing efforts, or to make adjustments when necessary. Developing and using specific milestones to guide and gauge progress toward achieving an agency’s desired results informs management of the rate of progress toward achieving goals or whether adjustments need to be made in order to maintain progress within given timeframes. However, NBIB leadership has not established goals or milestones for reducing the size of the investigation backlog, or goals for increasing total investigator capacity—for both federal employees and contractor personnel. As a result, the value of NBIB’s backlog analysis is limited, because it is not part of a broader plan to address the backlog and achieve timeliness objectives. Further, the extent to which NBIB should adjust its investigator capacity in the future remains unclear, as the currently projected capacity levels are not tied to any established goals or milestones to address the backlog or achieve the timeliness objectives. In addition to increasing investigative capacity, NBIB personnel are attempting to decrease the backlog by making the background investigation process more effective and efficient. To do so, NBIB conducted a business process reengineering effort that was intended to identify challenges in the process and their root causes. This effort identified 57 challenges, which were divided into five main categories that affected multiple phases of the background investigation process. NBIB then developed five portfolios, with 21 initiatives, to address the identified challenges. For example, one of the categories of challenges was poor data quality at the start of the investigation, which was described as related to issues such as no auto-validation of information, no pre- population of forms, and variable quality of submissions. NBIB developed four initiatives related to automation and digitization to improve the quality of this information. NBIB officials said that this business process reengineering effort is working to reduce the investigative level of effort across the community. Specifically, NBIB officials cited efforts that have been implemented to reduce the number of personnel hours necessary to complete an investigation, such as centralizing interviews and using video-teleconferencing for overseas investigations (to decrease travel time), automated record checks, and focused writing (to make reports more succinct and less time-consuming to prepare). However, NBIB has not identified how the implementation of the business process reengineering effort will affect the backlog or the need for additional investigators in the future. Without a plan, including goals and milestones, for reducing the backlog, which includes a determination of the effect of the business process reengineering efforts on the backlog, NBIB will lack the information and a course of action needed to effectively manage the inventory of pending investigations it conducts on behalf of other executive branch agencies. Further, without establishing goals for increasing total investigator capacity—for both federal employees and contractor personnel—in accordance with the plan for reducing the backlog, NBIB may not be positioned to achieve the goals and milestones outlined in that plan. Ultimately, if NBIB is unable to reduce the backlog, executive branch agencies will continue to lack the cleared personnel needed to help execute their respective missions, which could decrease the agencies’ overall effectiveness and efficiency, and pose risks to national security. NBIB Has Identified Some Workforce Needs but Does Not Have a Strategic Workforce Plan Our review of NBIB planning and workforce documents indicates that it has taken workforce planning steps. For example, the bureau developed a transition plan to help guide the transition from FIS to NBIB. This plan includes a request for a personnel study for its new Contracting and Business Solutions department to determine any needs or realignment of resources, skills, or qualification gaps; however, the transition plan does not mention a personnel study to address the needs of any other departments within NBIB. NBIB officials stated that the bureau conducted this study in early fiscal year 2017, and those results are being used to build the Contracting and Business Solutions department. NBIB officials said that NBIB plans to conduct a personnel study for its other departments once there is greater clarity and direction regarding the conduct of background investigations as a result of the plan developed by DOD to conduct its own investigations and any subsequent direction from Congress and the Administration. The officials stated that the personnel study was needed for the contracting department because this work had not been done in NBIB before and so they needed to establish a baseline for staffing it. As previously discussed, section 951 of the National Defense Authorization Act for Fiscal Year 2017 required, among other things, the Secretary of Defense to develop an implementation plan for the Defense Security Service to conduct background investigations for certain DOD personnel—presently conducted by OPM—after October 1, 2017. Additionally, in November 2017, as this report was in its final stages, Congress passed a bill for the National Defense Authorization Act for Fiscal Year 2018, which includes a provision that, among other things, would authorize DOD to conduct its own background investigations. It would also require DOD to begin carrying out the implementation plan developed in response to section 951 by October 1, 2020. The legislation would further require the Secretary of Defense, in consultation with the Director of OPM, to provide for a phased transition of the conduct of investigations from NBIB to the Defense Security Service. Moreover, this legislation would require the Secretary of Defense to conduct a comprehensive assessment of workforce requirements for both DOD and NBIB as part of planning for the transfer of certain functions from OPM to DOD. In addition, the NBIB transition team developed a talent acquisition strategy for the establishment of the bureau; however, this strategy was focused solely on filling nine key leadership positions (according to NBIB officials, four positions are senior executive service positions, and five are general schedule grade 14 and 15 positions). As of July 2017, NBIB officials said that six of these positions had been filled, and that another position was in the process of being staffed. The only mention of other positions in this strategy was a statement that once these key leadership positions have been filled, executives should build their respective departments consistent with mission needs and aligned with the NBIB strategic plan, and that NBIB use current FIS leadership for field operations, engagements and customer service, and integrity assurance. According to NBIB officials, NBIB has 3,260 positions authorized by OPM but had 495 vacancies as of July 1, 2017—approximately a 15 percent vacancy rate. NBIB officials said that most positions were not affected by the recent executive-branch hiring freeze, including investigators and investigative assistants, because they qualified for national security waivers; however, some positions, such as administrative support, were not covered by the waivers. The greatest total number of vacancies within NBIB is in its field operations department, which as of July 2017 had almost 400 vacancies, or a vacancy rate of about 17 percent. The Field Operations department provides contractor oversight, including program and project managers for fieldwork and CORs; it also includes federal investigator staff. NBIB officials stated that their greatest challenge in filling vacancies has been with their investigative workforce, and that as they fill their investigator positions, they will be able to better perform their mission of delivering completed background investigations in a timely manner due to having greater capacity. NBIB officials told us that they plan to hire another 200 federal investigators in fiscal year 2017 to help address the backlog of investigations; however, hiring 200 new federal investigator positions was not listed as a step on the transition plan for the Field Operations department, and these new investigator positions also are not included in the planned new hires listing of personnel hiring priorities. NBIB officials said that these new investigator positions were not included in the transition plan because the decision to hire for these positions had already been made and the hiring was being executed when the transition plan was developed. Furthermore, NBIB has developed detailed plans to hire new personnel. NBIB’s listing of personnel hiring priorities showed that NBIB initially planned to hire 155 new personnel. NBIB officials explained that in developing this initial hiring plan, organizational leaders assessed OPM legacy resources that would align with NBIB’s mission, roles and responsibilities, and identified gaps. These officials stated that at a leadership offsite held in December 2016, small groups identified existing and notional resources, prioritized resource gaps for identified programs, and briefed out their assessment of priorities. These officials said that the offsite participants then selected the top priorities for fiscal years 2017 and 2018, and that NBIB leadership subsequently developed individualized proposals outlining revisions and changes to personnel requirements and organization of each of the program areas. NBIB officials said that they subsequently refined these plans and reduced the number of planned new hires. The officials stated that in 2017, NBIB established a transitional hiring committee to further prioritize and select the final NBIB personnel structure, and that through a series of meetings in March, May, and June 2017, they refined their plans to reduce the number of planned new positions. As of July 2017, they said that NBIB planned to create and fill 49 new positions. According to NBIB officials, 13 of the new positions would involve an increase to the budget. Of those 49 new positions, they said that 21 had been filled as of July 2017. In addition, NBIB uses contractor support to fill some positions in its Field Operations, Federal Investigative Records Enterprise, and customer service departments, but NBIB officials did not provide documentation explaining the determinations for which tasks should be performed by contractors versus federal employees. NBIB officials stated that they followed a deliberative process requiring a thoughtful assessment of the personnel resource skills and competencies required to address the new NBIB objectives, but they could not provide any supporting documentation to that effect. A key principle of strategic workforce planning is determining the critical skills and competencies needed to achieve current and future programmatic results, such as identifying how the agency will obtain the workforce skills and competencies that are critical to achieving its strategic goals. In addition, OPM’s workforce planning best practices include forecasting the optimal headcount and competencies needed to meet the needs of the organization in the future, and a gap analysis to identify headcount surpluses and deficiencies for current and future demand levels. Further, OMB policy requires agencies to take actions to ensure they have sufficient internal capability to maintain control over functions that are core to the agency’s mission and operations. However, NBIB officials were unable to provide us with documentation that identified any of the gaps or explained the rationale for its determinations about the specific number and positions of additional staff needed. The documents they did provide appeared to be summaries of the revisions and changes decided upon, and included detailed information about the identified staffing requirements, such as information about the number of positions, position titles and types, grade levels, and hiring priority. While this information reflects detailed planning and thought, it does not illuminate whether the quantities and types of positions identified are the appropriate positions with the right critical skills and competencies needed to address any gaps in the bureau’s workforce. NBIB officials said that the hiring plans were originally determined at the leadership offsite, where the rationale for the specific number and positions of additional staff was discussed orally, and then further refined at a series of meetings beginning in March 2017. The officials told us that extensive review went into determining the rationale for the requests for new staff, and that these requests were the subject of robust and sometimes contentious debate, after which the requests were voted on by senior leadership. Although NBIB has taken some steps to develop and implement certain strategic workforce planning elements, it has not created a comprehensive, formal workforce plan that is focused on workforce needs to reduce the backlog. Such a plan should include the workforce skills and competencies that are critical to achieving NBIB’s strategic goals. As we previously reported, the most important consideration in identifying needed skills and competencies is that they are clearly linked to the agency’s mission and long-term goals developed jointly with key congressional and other stakeholders during the strategic planning process. If an agency identifies staff needs without linking the needs to strategic goals, or if the agency has not obtained agreement from key stakeholders on the goals, the needs assessment may be incomplete and premature. In addition, a strategic workforce plan could enable NBIB to (1) develop hiring, training, staff development, succession planning, performance management, use of flexibilities, and other human capital strategies and tools that could be implemented with the resources that can be reasonably expected to be available; and (2) eliminate gaps and improve the contribution of critical skills and competencies that they have identified between the future and current skills and competencies needed for mission success. NBIB officials explained that a strategic workforce plan is something they should create, but that as a new organization the bureau was focused on other priorities, such as hiring a director, selecting the headquarters location, addressing the backlog, and filling vacant positions. However, after being operational for almost a year, NBIB still lacks a comprehensive workforce plan. While it has taken several other steps intended to strengthen the background investigation process, without a formal strategic workforce plan, NBIB does not know whether the identified needs in its new hires, transition plan, and overall workforce vacancies will provide the appropriate mix of personnel. Specifically, it does not know whether it has the appropriate mix of federal employees and contractors, with the right critical skills and competencies, to address any staffing gaps and better enable the bureau to fulfill its mission. A comprehensive strategic workforce plan that focuses on the workforce and organizational elements needed and addresses capacity issues related to its vacancies would better position NBIB to address its investigation backlog. Additionally, a comprehensive strategic workforce plan would better position the bureau to execute its roles and responsibilities related to overseeing the background investigations for DOD and other executive branch agencies that rely on NBIB as their investigative service provider. Conclusions The PAC has made progress in reforming the personnel security clearance process. However, 13 years after the passage of IRTPA, it is now at a crossroads. The backlog of background investigations totaled over 700,000 cases as of September 2017 and while the executive branch is taking actions to help address it, there are no indications that the government can readily do so. We have noted in prior work concerns about the quality of background investigations and have emphasized the need to build quality throughout the personnel security clearance process for nearly two decades. Even though it has made significant attempts, the executive branch has still not established government-wide performance measures for the quality of background investigations to help ensure that critical security-relevant information is identified and mitigated when granting a security clearance. Over the past 2 years, the executive branch has taken steps toward establishing such measures. However, ODNI, as the Security Executive Agent, and the PAC have not prioritized setting a milestone for their completion. Without a milestone for establishing government-wide performance measures for the quality of investigations, their completion may be further delayed, and executive branch agencies will not have a schedule against which they can track progress or to which they are accountable. Executive branch timeliness in completing initial secret and initial top secret clearances has declined over the past 5 years. While ODNI has taken some steps to correct this downward trend on an agency-by- agency basis, neither ODNI nor the PAC have led a government-wide approach to improve the timeliness of initial personnel security clearances. While ODNI requests that agencies submit corrective action plans when they are not meeting timeliness objectives, it has not developed a comprehensive, government-wide plan with goals and milestones. A government-wide plan would help position ODNI, as the Security Executive Agent, as well as the PAC, to better identify and address systemic issues across the executive branch that affect the ability of agencies to meet timeliness objectives. IRTPA also created greater transparency and oversight of the overall reform effort by mandating annual reports to the appropriate congressional committees on the progress made toward meeting the act’s requirements, including reporting timeliness data. However, since the IRTPA reporting requirement ended in 2011, executive branch reporting has been limited, which makes it difficult to thoroughly evaluate and precisely identify where and why delays exist within the process, as well as to direct corrections as necessary. Without transparent reporting on investigation and adjudication timeliness, for both initial investigations and periodic reinvestigations, Congress will not be able to effectively execute its oversight role and monitor individual executive branch agency progress in meeting timeliness objectives. The establishment of NBIB in 2016, to strengthen the background investigation process, involved a number of organizational changes and efforts to improve the process. While NBIB has taken steps to increase its investigative capacity, it faces challenges in developing a comprehensive plan, with goals and milestones, to address the investigation backlog. Without such a plan, NBIB lacks a necessary course of action to reduce the backlog to a manageable level. Relatedly, NBIB has not established goals for increasing total investigator capacity. Establishing such goals, in accordance with the plan for reducing the backlog, may better position NBIB to achieve the goals and milestones outlined in that plan. Ultimately, if NBIB is unable to reduce the investigation backlog, executive branch agencies will continue to lack the cleared personnel needed to help execute their respective missions, which poses potential risks to national security. Demonstrated leadership from ODNI, in the capacity as the Security Executive Agent, and the PAC, by assisting NBIB as it works to reduce the investigation backlog could better position NBIB to reach a manageable level of investigations. Additionally, NBIB faces operational challenges related to workforce planning. While the bureau has taken a number of workforce planning steps, such as identifying specific hiring needs, it has not developed a strategic workforce plan. As a result, it may not know whether it has planned for the appropriate mix of personnel, with the right critical skills and competencies, and it has experienced delays in addressing its hiring needs. A comprehensive strategic workforce plan that focuses on the workforce and organizational elements needed and addresses capacity issues related to its vacancies would better position NBIB to address its investigation backlog and strengthen the investigation process. Matter for Congressional Consideration Congress should consider reinstating the Intelligence Reform and Terrorism Prevention Act of 2004’s requirement for the executive branch to report annually to appropriate committees of Congress on the amount of time required by authorized investigative and adjudicative agencies to conduct investigations, adjudicate cases, and grant initial personnel security clearances. Congress should also consider adding to this reporting requirement the amount of time required to investigate and adjudicate periodic reinvestigations and any other information deemed relevant, such as the status of the investigation backlog and implementing government-wide measures for the quality of investigations or other reform efforts. (Matter for Consideration 1) Recommendations for Executive Action We are making a total of six recommendations, including three to ODNI, in coordination with the PAC, and three to NBIB. Specifically, The Director of National Intelligence, in his capacity as Security Executive Agent, and in coordination with the other Security, Suitability, and Credentialing Performance Accountability Council Principals—the Deputy Director for Management of OMB in his capacity as Chair of the PAC, the Director of OPM, and the Under Secretary of Defense for Intelligence—should take the following three actions: establish a milestone for the completion of government-wide performance measures for the quality of investigations; (Recommendation 1) conduct an evidence-based review of the investigation and adjudication timeliness objectives for completing the fastest 90 percent of initial secret and initial top secret security clearances, and take action to adjust the objectives if appropriate; (Recommendation 2) and develop a government-wide plan, including goals and interim milestones, to meet those timeliness objectives for initial personnel security clearance investigations and adjudications. (Recommendation 3) The Director of NBIB, in coordination with the Deputy Director for Management of OMB, in the capacity as Chair of the PAC, and the Director of National Intelligence, in the capacity as Security Executive Agent, should take the following two actions: develop a plan, including goals and milestones, that includes a determination of the effect of the business process reengineering efforts for reducing the backlog to a “healthy” inventory of work, representing approximately 6 weeks of work; (Recommendation 4) and establish goals for increasing total investigator capacity—federal employees and contractor personnel—in accordance with the plan for reducing the backlog of investigations. (Recommendation 5) The Director of NBIB should build upon NBIB’s current workforce planning efforts by developing and implementing a comprehensive strategic workforce plan that focuses on what workforce and organizational needs and changes will enable the bureau to meet the current and future demand for its services. (Recommendation 6) Agency Comments and Our Evaluation We provided a draft of this report to OMB, ODNI, OPM, DOD, the Department of Justice, and the Department of Homeland Security for review and comment. OMB provided its comments via email, and the comments are summarized below. Written comments from ODNI and OPM are reprinted in their entirety in appendixes V and VI, respectively. OMB, ODNI, OPM, and the Department of Homeland Security provided additional technical comments, which we incorporated in the report as appropriate. DOD and the Department of Justice did not provide comments. OMB and OPM concurred with the recommendations directed to them. ODNI stated that it did not concur with the report’s conclusions and recommendations, but did not specifically state with which recommendations it did not concur. In comments e-mailed to us on November 9, 2017, the Acting Deputy Director for Management of OMB concurred with the report’s findings, conclusions, and recommendations. The comments also stated that the administration is committed to renewing public reporting of security clearance timeliness, once the government-wide reform initiatives are announced in early 2018, either as one of the administration’s cross- cutting priority goals or via another approach. While the PAC’s prior public reporting on the status of security clearance reform efforts was beneficial and helped to provide for transparency of the process, we believe that security clearance timeliness information should be reported—whether publicly or via reporting to Congress—broken out by individual executive branch agency and not only as an executive branch-wide average, as noted in our Matter for Congressional Consideration. As discussed in the report, such detailed reporting could help congressional decision-makers and OMB to thoroughly evaluate and precisely identify where and why delays exist within the process, as well as to direct corrections as necessary. In addition, OMB stated that the PAC is committed to ensuring that its Implementation Plan is continually updated to reflect the current status of reform efforts and that it incorporates any new initiatives arising from our review. In its written comments, ODNI stated that the report appears to draw negative inferences from the facts and that the conclusions do not present an accurate assessment of the current status of the personnel security clearance process. ODNI also stated that the conclusions do not include the significant progress ODNI has achieved in coordination with executive branch agencies. We disagree with these statements. The report discusses in detail the progress that the PAC—of which ODNI is a Principal member—has made to reform the personnel security clearance process, including the implementation of recommendations and milestones from the 120-day and 90-day reviews, and cross-agency priority goal updates. The report also discusses areas of progress highlighted by ODNI officials, such as the development of seven Security Executive Agent Directives, the issuance of Quality Assessment Standards for background investigations, and the implementation of the QART. In its comments, ODNI further stated that while it generally concurred with the factual observations in the report, it did not concur with our recommendations. While ODNI did not specifically state with which recommendations it disagreed, it discussed each of the three recommendations addressed to it. In addition, ODNI stated that it did not concur with our conclusions, and provided specific observations in the following three areas, which lead to the three recommendations. First, ODNI disagreed with our conclusion that it has not prioritized setting a milestone for the completion of government-wide performance measures for the quality of background investigations. ODNI also stated that the report ignores significant progress that ODNI has made in this area; specifically, the approval of Quality Assessment Standards for background investigations and the implementation of the QART. We disagree with ODNI’s position, as the report discusses in detail both the Quality Assessment Standards and the QART, and identifies these as the two steps toward the development of performance measures for the quality of background investigations. Additionally, ODNI stated that it has the ability to determine trends in background investigative quality from the data collected by the QART. However, as we note in the report, DOD background investigations—which represent the majority of the investigations conducted by NBIB—are not captured by the QART. We further noted that according to NBIB officials, they are not positioned to receive comprehensive feedback if their largest customer, DOD, is not utilizing the QART. Therefore, as we concluded in the report, it is unclear how ODNI will have sufficient data to develop government-wide measures for the quality of investigations since it will lack data for a significant portion of the executive branch’s background investigations. Regarding our recommendation that the Director of National Intelligence, in coordination with the other PAC Principals, establish a milestone for the completion of government-wide performance measures for the quality of investigations, ODNI stated that it is premature to do so and that it will set a milestone once the QART metrics discussed above have been fully analyzed. However, in its written comments, ODNI did not state when it anticipates the QART metrics will be fully analyzed. We recognize that fully analyzing the QART data may take time and that initial performance measures may be refined as ODNI collects and assesses data regarding the quality of background investigations. However, setting a milestone— that takes into consideration the amount of time needed to analyze QART data—will help to ensure that the analysis is completed, that initial performance measures are developed, and that agencies will have a greater understanding of what they are being measured against. We identify in the report that the executive branch previously set a milestone for the completion of government-wide performance measure for quality, which was adjusted over time and most recently set as October 2015. We further identify that the PAC has set milestones for the completion of nearly 50 other initiatives in its Implementation Plan, and that in the aftermath of the 2013 Washington Navy Yard shooting, the PAC (which includes ODNI) issued a 120-day review report that, among other things, recommended reporting on measures for quality. We continue to believe that setting a milestone could help to prevent further delays to their completion and provide the executive branch with a schedule against which it would be accountable. Second, ODNI did not agree with our conclusion that neither ODNI nor the PAC have led a government-wide approach to improve timeliness of initial personnel security clearances. In its written comments, ODNI discusses actions it has taken to improve timeliness since the passage of IRTPA, including resetting timeliness goals for certain clearances in 2012, in coordination with interagency stakeholders, issuing annual memorandums to agencies on their performance, and requesting that agencies develop agency-specific corrective action plans. We discuss all of these actions in the report and while we agree that they are positive actions, the executive branch would further benefit from a more coordinated approach. For example, even with the cited actions, the executive branch is experiencing significant challenges related to the timely processing of initial personnel security clearances. Specifically, as discussed in the report, in fiscal year 2016, only 2 percent of the agencies for which ODNI provided timeliness data met the 40-day IRTPA- established investigation objective for at least three of four quarters for the fastest 90 percent of initial secret cases; and only 12 percent met ODNI’s revised investigation objective for at least three of four quarters for the fastest 90 percent of initial top secret cases. In addition, as discussed in the report, timeliness challenges are not only an issue for agencies that use NBIB as their investigative service provider. Agencies with delegated authority to conduct their own investigations have also experienced timeliness challenges over the past 5 fiscal years. Further, the timeliness challenges cited by agencies to GAO include government- wide challenges, such as the increased investigative requirements—not just agency-specific challenges, such as staffing shortfalls. A government- wide plan would better position ODNI to identify and address any systemic government-wide issues. Regarding our recommendation that the Director of National Intelligence, in coordination with the other PAC Principals, conduct an evidence-based review of the timeliness objectives for completing initial secret and initial top secret security clearances, and take action to adjust the objectives if appropriate, ODNI stated that it is premature to revise the existing timeliness goals until NBIB’s backlog is resolved. In its written comments, ODNI states that while timeliness has exceeded the established standards, this is not necessarily an indication of a flaw in timeliness goals, but an indicator of the impact of the backlog and that as such, the current challenge in meeting timeliness should not serve as the sole basis for modifying existing goals. Our recommendation is to conduct an evidence-based review of the timeliness objectives, through which ODNI could determine whether there are any issues with the timeliness goals or, as ODNI suggests, whether the timeliness challenges are just a reflection of the backlog. At the conclusion of that review, ODNI can determine if it is appropriate to adjust the timeliness objectives, and take action if necessary. We do not suggest that ODNI should immediately revise the timeliness objectives without first determining if there is an evidence-based need to do so. ODNI further notes that other agencies that are not supported by NBIB are still achieving or very close to achieving current standards. However, as discussed in the report, even agencies with delegated authority to conduct their own investigations are experiencing challenges meeting established timeliness objectives. ODNI further stated in response to our recommendation that the Director of National Intelligence will continue to assess the impact of the implementation of the 2012 Federal Investigative Standards and modify the timeliness goals as appropriate. Given that ODNI has not comprehensively revisited the investigation or adjudication timeliness objectives for initial security clearances since 2012 despite the increased investigative requirements stemming from the implementation of the 2012 Federal Investigative Standards, we continue to believe that our recommendation to conduct an evidence-based review, using relevant data, is valid. Third, ODNI disagreed with our conclusion that demonstrated leadership from ODNI, in the capacity as the Security Executive Agent, and the PAC, by assisting NBIB as it works to reduce the investigation backlog could better position NBIB to reach a manageable level of investigations. ODNI stated that it has demonstrated leadership in this area and has worked closely as the Security Executive Agent with NBIB to reduce its investigation backlog and noted recent efforts by the Director of National Intelligence and the other PAC Principals to help reduce the backlog. We believe that these recent actions, which have taken place since the completion of our review, are positive steps that, along with our recommendations to NBIB, could help to reduce the backlog of background investigations. However, as discussed in the report, prior to these recent actions, ODNI had not demonstrated the leadership necessary to improve executive branch timeliness, as evidenced by the decrease in the number of agencies meeting timeliness objectives from fiscal years 2012 through 2016 and a backlog of over 700,000 investigations as of September 2017. Additionally, while the recent actions could help to reduce the backlog, sustained demonstrated leadership by the Director of National Intelligence and the other PAC Principals will be crucial to maintaining and increasing momentum, and ultimately critical to comprehensively addressing the current timeliness challenges and reducing the investigation backlog. Regarding our recommendation that the Director of National Intelligence develop a government-wide plan, including goals and interim milestones, to meet timeliness objectives for initial personnel security clearances, ODNI stated that it has already established timeliness goals for the security clearance process and that prior to the investigation backlog, which was created, in part, due to a loss of OPM investigator capacity, the executive branch met those goals. ODNI further stated that until NBIB reduces its backlog, departments and agencies that use NBIB cannot accurately predict budgetary requirements for the phases of the security clearance process under their control, which complicates the development of a government-wide plan at this time. However, as discussed in the report, the most feasible date by which NBIB could reduce the backlog of background investigations to a “healthy” inventory level is fiscal year 2022 at the earliest. Given the significant timeliness challenges that the executive branch is currently experiencing, agencies would benefit from developing a government-wide plan now, rather than waiting at least 5 years for the reduction of the backlog to do so. In addition, through the development of a government-wide plan, ODNI could help to identify additional actions to more quickly reduce the investigation backlog. Without such a plan, continued delays in processing clearances may leave agencies unable to fill critical positions that require a security clearance. Ultimately, developing a government- wide plan, including goals and interim milestones, will better ensure timely determinations of individuals’ eligibility for access to classified information. As such, we continue to believe that the recommendation is valid. In its written comments, OPM concurred with the three recommendations directed to NBIB, and described some actions it plans to take to address them. Separate from the recommendations, OPM also provided comments related to the discussion in the draft report regarding DOD’s development of NBIS and the security of OPM’s IT systems and data. Specifically, OPM expressed concerns about some of the statements by DOD officials, stating that they were unverified opinions. We agree that including the countering views of OPM officials could provide some helpful context. As a result, we have added language to the report to include OPM’s perspectives on the statements made by the DOD CIO officials. In addition, OPM stated that the prior GAO and OPM Inspector General audits referenced in the IT discussion were outdated audit assessments. We agree that some information in the draft report from the prior audits was based on reports from 2016 or earlier in 2017, and we understand that circumstances may have changed since those reports were issued. Specifically, the OPM Inspector General released a new audit report in October 2017, when this report was with the agency for comment, regarding the state of security of OPM IT systems. Accordingly, we replaced the discussion of the older OPM Inspector General reports in the draft report with a discussion of the OPM Inspector General’s October 2017 report. This latest OPM Inspector General report found, among other things, that OPM had made improvements in its security assessment and authorization program, and its previous “material weakness” related to authorizations has been upgraded to a “significant deficiency” for fiscal year 2017. Overall, the OPM Inspector General found that OPM’s cybersecurity maturity level was measured at a level 2, “Defined”, meaning that its policies, procedures and strategy were formalized and documented, but were not consistently implemented. We also added language to emphasize the date of the 2016 GAO reports, and added information about the status of the recommendations from those two reports, because none of the recommendations directed to OPM from the two 2016 GAO reports had been closed as implemented as of November 2017. OPM further stated that it has implemented critical enhancements to strengthen the security of OPM’s networks and has improved its security and assessment authorization process. In the draft report, we stated that OPM has strengthened the security of its networks, and we noted that— as stated in our 2017 report—OPM has made progress in improving its security to prevent, mitigate, and respond to data breaches involving sensitive personal records and background investigations information. However, as we noted our 2017 report, we also found that OPM did not effectively monitor actions taken to remediate identified weaknesses, and we continue to believe that discussion of the deficiencies we identified in our prior reports is appropriate in this report. In November 2017, after the conclusion of our audit work, Congress passed a bill for the National Defense Authorization Act for Fiscal Year 2018. Among other things, the bill includes a provision that would authorize DOD to conduct its own background investigations and require DOD to begin carrying out the implementation plan required by section 951 of the National Defense Authorization Act for Fiscal Year 2017 by October 1, 2020. It would also require the Secretary of Defense, in consultation with the Director of OPM, to provide for a phased transition. While this pending legislation may affect how some background investigations are conducted, we believe that our recommendations remain important points on which the executive branch should focus in order to help improve the security clearance process as these legislative changes are implemented. We are sending copies of this report to the appropriate congressional committees, the Director of National Intelligence, the Secretary of Defense, the Director of OMB, the Secretary of Homeland Security, the Director of OPM, the Director of NBIB, the Attorney General of the United States, the Director of the Federal Bureau of Intelligence, and the Director of the Bureau of Alcohol, Tobacco, Firearms, and Explosives. In addition, this report will also be available at no charge on the GAO website at http://www.gao.gov. If you or your members of your staff have any questions regarding this report, please contact me at (202) 512-3604 or farrellb@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made significant contributions to this report are listed in appendix VII. Appendix I: Status of Prior GAO Personnel Security Clearance Recommendations to Executive Branch Agencies as of November 2017 Since May 2009, we have made 37 recommendations to appropriate executive branch agencies—the Office of Management and Budget (OMB), Office of Personnel Management (OPM), Office of the Director of National Intelligence (ODNI), Department of Defense (DOD), and Department of Homeland Security (DHS)—to improve the personnel security clearance process. As of November 2017, these agencies had implemented 12 of those recommendations; we closed 4 due to the inaction of the responsible agencies; and 21 remained open. Examples of implemented recommendations include DOD’s issuance of adjudication guidance related to incomplete investigative reports, ODNI and OPM’s jointly proposed chapter and part to the Code of Federal Regulations clarifying, among other things, the position sensitivity designation of national security positions, and DHS’s issuance of new standards for tracking information on security clearance revocations and appeals. The 21 recommendations that remain open as of November 2017 focused on different aspects of the personnel security clearance process. First, in February 2012, we reported on background investigation pricing and costs, and we found, among other things, that the Performance Accountability Council had not provided the executive branch with guidance on cost savings. Second, in September 2014, we reported on the security clearance revocation processes at DHS and DOD. We found that DHS and DOD data systems did not track complete revocation information; there was inconsistent implementation of the requirements in the governing executive orders by DHS, DOD, and some of their components; and there was limited oversight over the revocation process, among other things. Third, in April 2015, we reported on the status of government-wide security clearance reform efforts. We found, among other things, that limited progress had been achieved in implementing updated Federal Investigative Standards, and that the extent to which reciprocity is granted government-wide was unknown. Fourth, in November 2017, we found that ODNI had taken an initial step to implement continuous evaluation across the executive branch, but it had not yet determined key aspects of the program; and it lacked plans for implementing, monitoring, and measuring program performance. See table 2 for the 21 open recommendations from these four reports as of November 2017. Appendix II: Overview of Selected Personnel Security Clearance Provisions in the Intelligence Reform and Terrorism Prevention Act of 2004 (IRTPA) Appendix II: Overview of Selected Personnel Security Clearance Provisions in the Intelligence Reform and Terrorism Prevention Act of 2004 (IRTPA) The 2004 enactment of IRTPA initiated a reform effort that includes goals and requirements for improving the personnel security clearance process government-wide. Specifically, among other things, IRTPA required that: The President select a single entity—currently designated as the Office of the Director of National Intelligence—to be responsible for, among other things, the development and implementation of uniform and consistent policies and procedures to ensure the effective, efficient, and timely completion of security clearances. The President, in consultation with the head of the entity above, select a single agency—currently designated as the National Background Investigations Bureau within the Office of Personnel Management (OPM)—tasked with conducting, to the maximum extent practicable, security clearance investigations of federal employees and contractor personnel, among other things. It also required this entity to ensure that investigations are conducted in accordance with uniform standards and requirements. All security clearance background investigations and determinations completed by an authorized investigative agency or authorized adjudicative agency be accepted by all agencies (known as reciprocity), subject to certain exceptions. Not later than 12 months after the date of enactment of the act, the Director of OPM in cooperation with the heads of the entities selected above, establish and commence operating and maintaining an integrated, secure database of personnel security clearance information. The executive branch evaluate the use of available information technology and databases to expedite investigative and adjudicative processes and to verify standard information submitted as part of an application for a security clearance and, not later than 1 year after enactment, submit a report to the President and the appropriate committees of Congress on the results of that evaluation. The executive branch submit an annual report, through 2011, to the appropriate congressional committees on the progress made toward meeting IRTPA requirements, including timeliness data and a discussion of any impediments to the smooth and timely functioning of IRTPA requirements. IRTPA also established specific objectives for the timeliness of security clearance processing. Specifically, the act required the entity selected under section 3001(b) to develop a plan to reduce the length of the personnel security clearance process, in consultation with appropriate committees of Congress and each authorized adjudicative agency. To the extent practical, the plan was to require that each authorized adjudicative agency make a determination on at least 90 percent of all applications for a personnel security clearance within an average of 60 days after the date of receipt of the completed application by an authorized investigative agency—not longer than 40 days to complete the investigative phase and 20 days to complete the adjudicative phase. IRTPA required the plan to take effect December 17, 2009. Appendix III: GAO Work on Personnel Security Clearance Quality and Executive Branch Efforts to Establish Government-wide Measures for the Quality of Investigations Since 1999 we have reported on issues related to investigative quality at the Department of Defense and the Office of Personnel Management and have issued recommendations to help ensure the personnel security clearance reform effort results in the development of metrics to track quality. Figure 6 provides an overview of our work in this area and executive branch efforts to establish government-wide performance measures for investigation quality. Appendix IV: Timeliness of Executive Branch Periodic Reinvestigations In November 2017, we reported on the timeliness of the executive branch’s periodic reinvestigations for fiscal years 2012 through 2016, among other things. Our analysis of timeliness data for select executive branch agencies showed that the percent of agencies meeting timeliness goals decreased from fiscal year 2012 through 2016. The timeliness goals for periodic reinvestigations are outlined in a 2008 Joint Security and Suitability Reform Team report to the President entitled Security and Suitability Process Reform. Specifically, the report includes Office of Management and Budget-issued interim government-wide processing goals for security clearances for calendar year 2008. The calendar year 2008 government-wide goal for the fastest 90 percent of periodic reinvestigations is the same as the goal currently in place: 15 days to initiate a case, 150 days to conduct the investigation, and 30 days to adjudicate—totaling 195 days to complete the end-to-end processing of the periodic reinvestigation. Table 3 shows the percent of executive branch agencies meeting the timeliness goals for investigating, adjudicating, and completing the fastest 90 percent of periodic reinvestigations for at least three of four quarters from fiscal years 2012 through 2016. Specific details of the timeliness of initial secret and initial top secret clearances for select individual executive branch agencies were omitted because the information is sensitive. Appendix V: Comments from the Office of the Director of National Intelligence Appendix VI: Comments from the Office of Personnel Management Appendix VII: GAO Contact and Staff Acknowledgments GAO Contact Staff Acknowledgments In addition to the contact named above, Kimberly Seay (Assistant Director), Nathan Tranquilli (Assistant Director), Renee S. Brown, Chris Businsky, Molly Callaghan, Jenny Chanley, Katheryn Hubbell, Saida Hussain, Jeffrey L. Knott, James Krustapentus, Caryn E. Kuebler, Michael Shaughnessy, Rachel Stoiko, Paul Sturm, John Van Schaik, Cheryl Weissman, and Jina Yu made significant contributions to this report. Related GAO Products Personnel Security Clearances: Additional Actions Needed to Address Quality, Timeliness, and Investigation Backlog. GAO-18-26SU. Washington, D.C.: December 7, 2017 (FOUO). Personnel Security Clearances: Additional Planning Needed to Fully Implement and Oversee Continuous Evaluation of Clearance Holders. GAO-18-159SU. Washington, D.C.: November 21, 2017 (FOUO). Personnel Security Clearances: Plans Needed to Fully Implement and Oversee Continuous Evaluation of Clearance Holders. GAO-18-117. Washington, D.C.: November 21, 2017. High-Risk Series: Progress on Many High-Risk Areas, While Substantial Efforts Needed on Others. GAO-17-317. Washington, D.C.: February 15, 2017. Personnel Security Clearances: Funding Estimates and Government- Wide Metrics Are Needed to Implement Long-Standing Reform Efforts. GAO-15-179SU. Washington, D.C.: April 23, 2015. Personnel Security Clearances: Additional Guidance and Oversight Needed at DHS and DOD to Ensure Consistent Application of Revocation Process. GAO-14-640. Washington, D. C.: September 8, 2014. Personnel Security Clearances: Actions Needed to Ensure Quality of Background Investigations and Resulting Decisions. GAO-14-138T. Washington, D.C.: February 11, 2014. Personnel Security Clearances: Actions Needed to Help Ensure Correct Designations of National Security Positions. GAO-14-139T. Washington, D.C.: November 20, 2013. Personnel Security Clearances: Opportunities Exist to Improve Quality Throughout the Process. GAO-14-186T. Washington, D.C.: November 13, 2013. Personnel Security Clearances: Full Development and Implementation of Metrics Needed to Measure Quality of Process. GAO-14-157T. Washington, D.C.: October 31, 2013. Personnel Security Clearances: Further Actions Needed to Improve the Process and Realize Efficiencies. GAO-13-728T. Washington, D.C.: June 20, 2013. Managing for Results: Agencies Should More Fully Develop Priority Goals under the GPRA Modernization Act. GAO-13-174. Washington, D.C.: April 19, 2013. Security Clearances: Agencies Need Clearly Defined Policy for Determining Civilian Position Requirements. GAO-12-800. Washington, D.C.: July 12, 2012. Personnel Security Clearances: Continuing Leadership and Attention Can Enhance Momentum Gained from Reform Effort. GAO-12-815T. Washington, D.C.: June 21, 2012. 2012 Annual Report: Opportunities to Reduce Duplication, Overlap and Fragmentation, Achieve Savings, and Enhance Revenue. GAO-12-342SP. Washington, D.C.: February 28, 2012. Background Investigations: Office of Personnel Management Needs to Improve Transparency of Its Pricing and Seek Cost Savings. GAO-12-197. Washington, D.C.: February 28, 2012. GAO’s 2011 High-Risk Series: An Update. GAO-11-394T. Washington, D.C.: February 17, 2011. High-Risk Series: An Update. GAO-11-278. Washington, D.C.: February 16, 2011. Personnel Security Clearances: Overall Progress Has Been Made to Reform the Governmentwide Security Clearance Process. GAO-11-232T. Washington, D.C.: December 1, 2010. Personnel Security Clearances: Progress Has Been Made to Improve Timeliness but Continued Oversight Is Needed to Sustain Momentum. GAO-11-65. Washington, D.C.: November 19, 2010. DOD Personnel Clearances: Preliminary Observations on DOD’s Progress on Addressing Timeliness and Quality Issues. GAO-11-185T. Washington, D.C.: November 16, 2010. Personnel Security Clearances: An Outcome-Focused Strategy and Comprehensive Reporting of Timeliness and Quality Would Provide Greater Visibility over the Clearance Process. GAO-10-117T. Washington, D.C.: October 1, 2009. Personnel Security Clearances: Progress Has Been Made to Reduce Delays but Further Actions Are Needed to Enhance Quality and Sustain Reform Efforts. GAO-09-684T. Washington, D.C.: September 15, 2009. Personnel Security Clearances: An Outcome-Focused Strategy Is Needed to Guide Implementation of the Reformed Clearance Process. GAO-09-488. Washington, D.C.: May 19, 2009. DOD Personnel Clearances: Comprehensive Timeliness Reporting, Complete Clearance Documentation, and Quality Measures Are Needed to Further Improve the Clearance Process. GAO-09-400. Washington, D.C.: May 19, 2009. High-Risk Series: An Update. GAO-09-271. Washington, D.C.: January 2009. Personnel Security Clearances: Preliminary Observations on Joint Reform Efforts to Improve the Governmentwide Clearance Eligibility Process. GAO-08-1050T. Washington, D.C.: July 30, 2008. Personnel Clearances: Key Factors for Reforming the Security Clearance Process. GAO-08-776T. Washington, D.C.: May 22, 2008. Employee Security: Implementation of Identification Cards and DOD’s Personnel Security Clearance Program Need Improvement. GAO-08-551T. Washington, D.C.: April 9, 2008. Personnel Clearances: Key Factors to Consider in Efforts to Reform Security Clearance Processes. GAO-08-352T. Washington, D.C.: February 27, 2008. DOD Personnel Clearances: DOD Faces Multiple Challenges in Its Efforts to Improve Clearance Processes for Industry Personnel. GAO-08-470T. Washington, D.C.: February 13, 2008. DOD Personnel Clearances: Improved Annual Reporting Would Enable More Informed Congressional Oversight. GAO-08-350. Washington, D.C.: February 13, 2008. DOD Personnel Clearances: Delays and Inadequate Documentation Found for Industry Personnel. GAO-07-842T. Washington, D.C.: May 17, 2007. High-Risk Series: An Update. GAO-07-310. Washington, D.C.: January 2007. DOD Personnel Clearances: Additional OMB Actions Are Needed to Improve the Security Clearance Process. GAO-06-1070. Washington, D.C.: September 28, 2006. DOD Personnel Clearances: New Concerns Slow Processing of Clearances for Industry Personnel. GAO-06-748T. Washington, D.C.: May 17, 2006. DOD Personnel Clearances: Some Progress Has Been Made but Hurdles Remain to Overcome the Challenges That Led to GAO’s High-Risk Designation. GAO-05-842T. Washington, D.C.: June 28, 2005. High-Risk Series: An Update. GAO-05-207. Washington, D.C.: January 2005.
target: A high-quality personnel security clearance process is necessary to minimize the risks of unauthorized disclosures of classified information and to help ensure that security-relevant information is identified and assessed. The passage of IRTPA initiated an effort to reform the security clearance process government-wide. This report assesses the extent to which (1) executive branch agencies made progress reforming the security clearance process; (2) executive branch agencies completed timely initial clearances from fiscal years 2012-2016, and reported on timeliness; and (3) NBIB has taken steps to improve the background investigation process and address the backlog. GAO reviewed documentation; analyzed timeliness data; and interviewed officials from the four PAC Principals and NBIB. This is a public version of a sensitive report that GAO issued in December 2017. Information that the DNI and OPM deemed sensitive has been omitted. Executive branch agencies have made progress reforming the security clearance process, but long-standing key initiatives remain incomplete. Progress includes the issuance of common federal adjudicative guidelines and updated strategic documents to help sustain the reform effort. However, agencies face challenges in implementing certain aspects of the 2012 Federal Investigative Standards—criteria for conducting background investigations—including establishing a continuous evaluation program, and the issuance of a reciprocity policy to guide agencies in honoring previously granted clearances by other agencies remains incomplete. Executive branch agencies have taken recent steps to prioritize over 50 reform initiatives to help focus agency efforts and facilitate their completion. In addition, while agencies have taken steps to establish government-wide performance measures for the quality of investigations, neither the Director of National Intelligence (DNI) nor the Security, Suitability, and Credentialing Performance Accountability Council (PAC) have set a milestone for their completion. Without establishing such a milestone, completion may be further delayed and agencies will not have a schedule against which they can track progress or to which they are accountable. The number of executive branch agencies meeting established timeliness objectives for initial security clearances decreased from fiscal years 2012 through 2016, and reporting has been limited. For example, 59 percent of the executive branch agencies reviewed by GAO reported meeting investigation and adjudication timeliness objectives for initial top secret clearances in fiscal year 2012, compared with 10 percent in fiscal year 2016. The Intelligence Reform and Terrorism Prevention Act of 2004 (IRTPA) required the executive branch to submit an annual report, through 2011, to appropriate congressional committees on, among other things, the time required to conduct investigations, adjudicate cases, and grant clearances. Since the requirement ended, reporting has been limited to a portion of the intelligence community. Without comprehensive reporting, Congress will not be able to monitor agencies' progress in meeting timeliness objectives, identify corrections, or effectively execute its oversight role. The National Background Investigations Bureau (NBIB), within the Office of Personnel Management (OPM), has taken steps to improve the background investigation process, but it faces operational challenges in addressing the investigation backlog and increasing investigator capacity. While NBIB has taken positive steps to improve its oversight of background investigation contracts, it faces operational challenges in reducing the investigation backlog—which grew from 190,000 cases in August 2014 to more than 709,000 in September 2017. To increase capacity NBIB has hired additional federal investigators and increased the number of its investigative fieldwork contracts, but it has not developed a plan for reducing the backlog or established goals for increasing total investigator capacity. Without such a plan and goals, the backlog may persist and executive branch agencies will continue to lack the cleared personnel needed to help execute their respective missions. The bill for the National Defense Authorization Act for Fiscal Year 2018, passed by Congress in November 2017, would authorize DOD to conduct its own background investigations.